1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #include <sys/types.h> 27 #include <sys/stream.h> 28 #include <sys/stropts.h> 29 #include <sys/strsubr.h> 30 #include <sys/errno.h> 31 #include <sys/ddi.h> 32 #include <sys/debug.h> 33 #include <sys/cmn_err.h> 34 #include <sys/stream.h> 35 #include <sys/strlog.h> 36 #include <sys/kmem.h> 37 #include <sys/sunddi.h> 38 #include <sys/tihdr.h> 39 #include <sys/atomic.h> 40 #include <sys/socket.h> 41 #include <sys/sysmacros.h> 42 #include <sys/crypto/common.h> 43 #include <sys/crypto/api.h> 44 #include <sys/zone.h> 45 #include <netinet/in.h> 46 #include <net/if.h> 47 #include <net/pfkeyv2.h> 48 #include <inet/common.h> 49 #include <netinet/ip6.h> 50 #include <inet/ip.h> 51 #include <inet/ip_ire.h> 52 #include <inet/ip6.h> 53 #include <inet/ipsec_info.h> 54 #include <inet/tcp.h> 55 #include <inet/sadb.h> 56 #include <inet/ipsec_impl.h> 57 #include <inet/ipsecah.h> 58 #include <inet/ipsecesp.h> 59 #include <sys/random.h> 60 #include <sys/dlpi.h> 61 #include <sys/iphada.h> 62 #include <inet/ip_if.h> 63 #include <inet/ipdrop.h> 64 #include <inet/ipclassifier.h> 65 #include <inet/sctp_ip.h> 66 #include <inet/tun.h> 67 68 /* 69 * This source file contains Security Association Database (SADB) common 70 * routines. They are linked in with the AH module. Since AH has no chance 71 * of falling under export control, it was safe to link it in there. 72 */ 73 74 static mblk_t *sadb_extended_acquire(ipsec_selector_t *, ipsec_policy_t *, 75 ipsec_action_t *, boolean_t, uint32_t, uint32_t, netstack_t *); 76 static void sadb_ill_df(ill_t *, mblk_t *, isaf_t *, int, boolean_t); 77 static ipsa_t *sadb_torch_assoc(isaf_t *, ipsa_t *, boolean_t, mblk_t **); 78 static void sadb_drain_torchq(queue_t *, mblk_t *); 79 static void sadb_destroy_acqlist(iacqf_t **, uint_t, boolean_t, 80 netstack_t *); 81 static void sadb_destroy(sadb_t *, netstack_t *); 82 static mblk_t *sadb_sa2msg(ipsa_t *, sadb_msg_t *); 83 84 static time_t sadb_add_time(time_t, uint64_t); 85 static void lifetime_fuzz(ipsa_t *); 86 static void age_pair_peer_list(templist_t *, sadb_t *, boolean_t); 87 static void ipsa_set_replay(ipsa_t *ipsa, uint32_t offset); 88 89 extern void (*cl_inet_getspi)(netstackid_t stack_id, uint8_t protocol, 90 uint8_t *ptr, size_t len, void *args); 91 extern int (*cl_inet_checkspi)(netstackid_t stack_id, uint8_t protocol, 92 uint32_t spi, void *args); 93 extern void (*cl_inet_deletespi)(netstackid_t stack_id, uint8_t protocol, 94 uint32_t spi, void *args); 95 96 /* 97 * ipsacq_maxpackets is defined here to make it tunable 98 * from /etc/system. 99 */ 100 extern uint64_t ipsacq_maxpackets; 101 102 #define SET_EXPIRE(sa, delta, exp) { \ 103 if (((sa)->ipsa_ ## delta) != 0) { \ 104 (sa)->ipsa_ ## exp = sadb_add_time((sa)->ipsa_addtime, \ 105 (sa)->ipsa_ ## delta); \ 106 } \ 107 } 108 109 #define UPDATE_EXPIRE(sa, delta, exp) { \ 110 if (((sa)->ipsa_ ## delta) != 0) { \ 111 time_t tmp = sadb_add_time((sa)->ipsa_usetime, \ 112 (sa)->ipsa_ ## delta); \ 113 if (((sa)->ipsa_ ## exp) == 0) \ 114 (sa)->ipsa_ ## exp = tmp; \ 115 else \ 116 (sa)->ipsa_ ## exp = \ 117 MIN((sa)->ipsa_ ## exp, tmp); \ 118 } \ 119 } 120 121 122 /* wrap the macro so we can pass it as a function pointer */ 123 void 124 sadb_sa_refrele(void *target) 125 { 126 IPSA_REFRELE(((ipsa_t *)target)); 127 } 128 129 /* 130 * We presume that sizeof (long) == sizeof (time_t) and that time_t is 131 * a signed type. 132 */ 133 #define TIME_MAX LONG_MAX 134 135 /* 136 * PF_KEY gives us lifetimes in uint64_t seconds. We presume that 137 * time_t is defined to be a signed type with the same range as 138 * "long". On ILP32 systems, we thus run the risk of wrapping around 139 * at end of time, as well as "overwrapping" the clock back around 140 * into a seemingly valid but incorrect future date earlier than the 141 * desired expiration. 142 * 143 * In order to avoid odd behavior (either negative lifetimes or loss 144 * of high order bits) when someone asks for bizarrely long SA 145 * lifetimes, we do a saturating add for expire times. 146 * 147 * We presume that ILP32 systems will be past end of support life when 148 * the 32-bit time_t overflows (a dangerous assumption, mind you..). 149 * 150 * On LP64, 2^64 seconds are about 5.8e11 years, at which point we 151 * will hopefully have figured out clever ways to avoid the use of 152 * fixed-sized integers in computation. 153 */ 154 static time_t 155 sadb_add_time(time_t base, uint64_t delta) 156 { 157 time_t sum; 158 159 /* 160 * Clip delta to the maximum possible time_t value to 161 * prevent "overwrapping" back into a shorter-than-desired 162 * future time. 163 */ 164 if (delta > TIME_MAX) 165 delta = TIME_MAX; 166 /* 167 * This sum may still overflow. 168 */ 169 sum = base + delta; 170 171 /* 172 * .. so if the result is less than the base, we overflowed. 173 */ 174 if (sum < base) 175 sum = TIME_MAX; 176 177 return (sum); 178 } 179 180 /* 181 * Callers of this function have already created a working security 182 * association, and have found the appropriate table & hash chain. All this 183 * function does is check duplicates, and insert the SA. The caller needs to 184 * hold the hash bucket lock and increment the refcnt before insertion. 185 * 186 * Return 0 if success, EEXIST if collision. 187 */ 188 #define SA_UNIQUE_MATCH(sa1, sa2) \ 189 (((sa1)->ipsa_unique_id & (sa1)->ipsa_unique_mask) == \ 190 ((sa2)->ipsa_unique_id & (sa2)->ipsa_unique_mask)) 191 192 int 193 sadb_insertassoc(ipsa_t *ipsa, isaf_t *bucket) 194 { 195 ipsa_t **ptpn = NULL; 196 ipsa_t *walker; 197 boolean_t unspecsrc; 198 199 ASSERT(MUTEX_HELD(&bucket->isaf_lock)); 200 201 unspecsrc = IPSA_IS_ADDR_UNSPEC(ipsa->ipsa_srcaddr, ipsa->ipsa_addrfam); 202 203 walker = bucket->isaf_ipsa; 204 ASSERT(walker == NULL || ipsa->ipsa_addrfam == walker->ipsa_addrfam); 205 206 /* 207 * Find insertion point (pointed to with **ptpn). Insert at the head 208 * of the list unless there's an unspecified source address, then 209 * insert it after the last SA with a specified source address. 210 * 211 * BTW, you'll have to walk the whole chain, matching on {DST, SPI} 212 * checking for collisions. 213 */ 214 215 while (walker != NULL) { 216 if (IPSA_ARE_ADDR_EQUAL(walker->ipsa_dstaddr, 217 ipsa->ipsa_dstaddr, ipsa->ipsa_addrfam)) { 218 if (walker->ipsa_spi == ipsa->ipsa_spi) 219 return (EEXIST); 220 221 mutex_enter(&walker->ipsa_lock); 222 if (ipsa->ipsa_state == IPSA_STATE_MATURE && 223 (walker->ipsa_flags & IPSA_F_USED) && 224 SA_UNIQUE_MATCH(walker, ipsa)) { 225 walker->ipsa_flags |= IPSA_F_CINVALID; 226 } 227 mutex_exit(&walker->ipsa_lock); 228 } 229 230 if (ptpn == NULL && unspecsrc) { 231 if (IPSA_IS_ADDR_UNSPEC(walker->ipsa_srcaddr, 232 walker->ipsa_addrfam)) 233 ptpn = walker->ipsa_ptpn; 234 else if (walker->ipsa_next == NULL) 235 ptpn = &walker->ipsa_next; 236 } 237 238 walker = walker->ipsa_next; 239 } 240 241 if (ptpn == NULL) 242 ptpn = &bucket->isaf_ipsa; 243 ipsa->ipsa_next = *ptpn; 244 ipsa->ipsa_ptpn = ptpn; 245 if (ipsa->ipsa_next != NULL) 246 ipsa->ipsa_next->ipsa_ptpn = &ipsa->ipsa_next; 247 *ptpn = ipsa; 248 ipsa->ipsa_linklock = &bucket->isaf_lock; 249 250 return (0); 251 } 252 #undef SA_UNIQUE_MATCH 253 254 /* 255 * Free a security association. Its reference count is 0, which means 256 * I must free it. The SA must be unlocked and must not be linked into 257 * any fanout list. 258 */ 259 static void 260 sadb_freeassoc(ipsa_t *ipsa) 261 { 262 ipsec_stack_t *ipss = ipsa->ipsa_netstack->netstack_ipsec; 263 264 ASSERT(ipss != NULL); 265 ASSERT(MUTEX_NOT_HELD(&ipsa->ipsa_lock)); 266 ASSERT(ipsa->ipsa_refcnt == 0); 267 ASSERT(ipsa->ipsa_next == NULL); 268 ASSERT(ipsa->ipsa_ptpn == NULL); 269 270 mutex_enter(&ipsa->ipsa_lock); 271 /* Don't call sadb_clear_lpkt() since we hold the ipsa_lock anyway. */ 272 ip_drop_packet(ipsa->ipsa_lpkt, B_TRUE, NULL, NULL, 273 DROPPER(ipss, ipds_sadb_inlarval_timeout), 274 &ipss->ipsec_sadb_dropper); 275 ipsec_destroy_ctx_tmpl(ipsa, IPSEC_ALG_AUTH); 276 ipsec_destroy_ctx_tmpl(ipsa, IPSEC_ALG_ENCR); 277 mutex_exit(&ipsa->ipsa_lock); 278 279 /* bzero() these fields for paranoia's sake. */ 280 if (ipsa->ipsa_authkey != NULL) { 281 bzero(ipsa->ipsa_authkey, ipsa->ipsa_authkeylen); 282 kmem_free(ipsa->ipsa_authkey, ipsa->ipsa_authkeylen); 283 } 284 if (ipsa->ipsa_encrkey != NULL) { 285 bzero(ipsa->ipsa_encrkey, ipsa->ipsa_encrkeylen); 286 kmem_free(ipsa->ipsa_encrkey, ipsa->ipsa_encrkeylen); 287 } 288 if (ipsa->ipsa_src_cid != NULL) { 289 IPSID_REFRELE(ipsa->ipsa_src_cid); 290 } 291 if (ipsa->ipsa_dst_cid != NULL) { 292 IPSID_REFRELE(ipsa->ipsa_dst_cid); 293 } 294 if (ipsa->ipsa_integ != NULL) 295 kmem_free(ipsa->ipsa_integ, ipsa->ipsa_integlen); 296 if (ipsa->ipsa_sens != NULL) 297 kmem_free(ipsa->ipsa_sens, ipsa->ipsa_senslen); 298 299 mutex_destroy(&ipsa->ipsa_lock); 300 kmem_free(ipsa, sizeof (*ipsa)); 301 } 302 303 /* 304 * Unlink a security association from a hash bucket. Assume the hash bucket 305 * lock is held, but the association's lock is not. 306 * 307 * Note that we do not bump the bucket's generation number here because 308 * we might not be making a visible change to the set of visible SA's. 309 * All callers MUST bump the bucket's generation number before they unlock 310 * the bucket if they use sadb_unlinkassoc to permanetly remove an SA which 311 * was present in the bucket at the time it was locked. 312 */ 313 void 314 sadb_unlinkassoc(ipsa_t *ipsa) 315 { 316 ASSERT(ipsa->ipsa_linklock != NULL); 317 ASSERT(MUTEX_HELD(ipsa->ipsa_linklock)); 318 319 /* These fields are protected by the link lock. */ 320 *(ipsa->ipsa_ptpn) = ipsa->ipsa_next; 321 if (ipsa->ipsa_next != NULL) { 322 ipsa->ipsa_next->ipsa_ptpn = ipsa->ipsa_ptpn; 323 ipsa->ipsa_next = NULL; 324 } 325 326 ipsa->ipsa_ptpn = NULL; 327 328 /* This may destroy the SA. */ 329 IPSA_REFRELE(ipsa); 330 } 331 332 void 333 sadb_delete_cluster(ipsa_t *assoc) 334 { 335 uint8_t protocol; 336 337 if (cl_inet_deletespi && 338 ((assoc->ipsa_state == IPSA_STATE_LARVAL) || 339 (assoc->ipsa_state == IPSA_STATE_MATURE))) { 340 protocol = (assoc->ipsa_type == SADB_SATYPE_AH) ? 341 IPPROTO_AH : IPPROTO_ESP; 342 cl_inet_deletespi(assoc->ipsa_netstack->netstack_stackid, 343 protocol, assoc->ipsa_spi, NULL); 344 } 345 } 346 347 /* 348 * Create a larval security association with the specified SPI. All other 349 * fields are zeroed. 350 */ 351 static ipsa_t * 352 sadb_makelarvalassoc(uint32_t spi, uint32_t *src, uint32_t *dst, int addrfam, 353 netstack_t *ns) 354 { 355 ipsa_t *newbie; 356 357 /* 358 * Allocate... 359 */ 360 361 newbie = (ipsa_t *)kmem_zalloc(sizeof (ipsa_t), KM_NOSLEEP); 362 if (newbie == NULL) { 363 /* Can't make new larval SA. */ 364 return (NULL); 365 } 366 367 /* Assigned requested SPI, assume caller does SPI allocation magic. */ 368 newbie->ipsa_spi = spi; 369 newbie->ipsa_netstack = ns; /* No netstack_hold */ 370 371 /* 372 * Copy addresses... 373 */ 374 375 IPSA_COPY_ADDR(newbie->ipsa_srcaddr, src, addrfam); 376 IPSA_COPY_ADDR(newbie->ipsa_dstaddr, dst, addrfam); 377 378 newbie->ipsa_addrfam = addrfam; 379 380 /* 381 * Set common initialization values, including refcnt. 382 */ 383 mutex_init(&newbie->ipsa_lock, NULL, MUTEX_DEFAULT, NULL); 384 newbie->ipsa_state = IPSA_STATE_LARVAL; 385 newbie->ipsa_refcnt = 1; 386 newbie->ipsa_freefunc = sadb_freeassoc; 387 388 /* 389 * There aren't a lot of other common initialization values, as 390 * they are copied in from the PF_KEY message. 391 */ 392 393 return (newbie); 394 } 395 396 /* 397 * Call me to initialize a security association fanout. 398 */ 399 static int 400 sadb_init_fanout(isaf_t **tablep, uint_t size, int kmflag) 401 { 402 isaf_t *table; 403 int i; 404 405 table = (isaf_t *)kmem_alloc(size * sizeof (*table), kmflag); 406 *tablep = table; 407 408 if (table == NULL) 409 return (ENOMEM); 410 411 for (i = 0; i < size; i++) { 412 mutex_init(&(table[i].isaf_lock), NULL, MUTEX_DEFAULT, NULL); 413 table[i].isaf_ipsa = NULL; 414 table[i].isaf_gen = 0; 415 } 416 417 return (0); 418 } 419 420 /* 421 * Call me to initialize an acquire fanout 422 */ 423 static int 424 sadb_init_acfanout(iacqf_t **tablep, uint_t size, int kmflag) 425 { 426 iacqf_t *table; 427 int i; 428 429 table = (iacqf_t *)kmem_alloc(size * sizeof (*table), kmflag); 430 *tablep = table; 431 432 if (table == NULL) 433 return (ENOMEM); 434 435 for (i = 0; i < size; i++) { 436 mutex_init(&(table[i].iacqf_lock), NULL, MUTEX_DEFAULT, NULL); 437 table[i].iacqf_ipsacq = NULL; 438 } 439 440 return (0); 441 } 442 443 /* 444 * Attempt to initialize an SADB instance. On failure, return ENOMEM; 445 * caller must clean up partial allocations. 446 */ 447 static int 448 sadb_init_trial(sadb_t *sp, uint_t size, int kmflag) 449 { 450 ASSERT(sp->sdb_of == NULL); 451 ASSERT(sp->sdb_if == NULL); 452 ASSERT(sp->sdb_acq == NULL); 453 454 sp->sdb_hashsize = size; 455 if (sadb_init_fanout(&sp->sdb_of, size, kmflag) != 0) 456 return (ENOMEM); 457 if (sadb_init_fanout(&sp->sdb_if, size, kmflag) != 0) 458 return (ENOMEM); 459 if (sadb_init_acfanout(&sp->sdb_acq, size, kmflag) != 0) 460 return (ENOMEM); 461 462 return (0); 463 } 464 465 /* 466 * Call me to initialize an SADB instance; fall back to default size on failure. 467 */ 468 static void 469 sadb_init(const char *name, sadb_t *sp, uint_t size, uint_t ver, 470 netstack_t *ns) 471 { 472 ASSERT(sp->sdb_of == NULL); 473 ASSERT(sp->sdb_if == NULL); 474 ASSERT(sp->sdb_acq == NULL); 475 476 if (size < IPSEC_DEFAULT_HASH_SIZE) 477 size = IPSEC_DEFAULT_HASH_SIZE; 478 479 if (sadb_init_trial(sp, size, KM_NOSLEEP) != 0) { 480 481 cmn_err(CE_WARN, 482 "Unable to allocate %u entry IPv%u %s SADB hash table", 483 size, ver, name); 484 485 sadb_destroy(sp, ns); 486 size = IPSEC_DEFAULT_HASH_SIZE; 487 cmn_err(CE_WARN, "Falling back to %d entries", size); 488 (void) sadb_init_trial(sp, size, KM_SLEEP); 489 } 490 } 491 492 493 /* 494 * Initialize an SADB-pair. 495 */ 496 void 497 sadbp_init(const char *name, sadbp_t *sp, int type, int size, netstack_t *ns) 498 { 499 sadb_init(name, &sp->s_v4, size, 4, ns); 500 sadb_init(name, &sp->s_v6, size, 6, ns); 501 502 sp->s_satype = type; 503 504 ASSERT((type == SADB_SATYPE_AH) || (type == SADB_SATYPE_ESP)); 505 if (type == SADB_SATYPE_AH) { 506 ipsec_stack_t *ipss = ns->netstack_ipsec; 507 508 ip_drop_register(&ipss->ipsec_sadb_dropper, "IPsec SADB"); 509 sp->s_addflags = AH_ADD_SETTABLE_FLAGS; 510 sp->s_updateflags = AH_UPDATE_SETTABLE_FLAGS; 511 } else { 512 sp->s_addflags = ESP_ADD_SETTABLE_FLAGS; 513 sp->s_updateflags = ESP_UPDATE_SETTABLE_FLAGS; 514 } 515 } 516 517 /* 518 * Deliver a single SADB_DUMP message representing a single SA. This is 519 * called many times by sadb_dump(). 520 * 521 * If the return value of this is ENOBUFS (not the same as ENOMEM), then 522 * the caller should take that as a hint that dupb() on the "original answer" 523 * failed, and that perhaps the caller should try again with a copyb()ed 524 * "original answer". 525 */ 526 static int 527 sadb_dump_deliver(queue_t *pfkey_q, mblk_t *original_answer, ipsa_t *ipsa, 528 sadb_msg_t *samsg) 529 { 530 mblk_t *answer; 531 532 answer = dupb(original_answer); 533 if (answer == NULL) 534 return (ENOBUFS); 535 answer->b_cont = sadb_sa2msg(ipsa, samsg); 536 if (answer->b_cont == NULL) { 537 freeb(answer); 538 return (ENOMEM); 539 } 540 541 /* Just do a putnext, and let keysock deal with flow control. */ 542 putnext(pfkey_q, answer); 543 return (0); 544 } 545 546 /* 547 * Common function to allocate and prepare a keysock_out_t M_CTL message. 548 */ 549 mblk_t * 550 sadb_keysock_out(minor_t serial) 551 { 552 mblk_t *mp; 553 keysock_out_t *kso; 554 555 mp = allocb(sizeof (ipsec_info_t), BPRI_HI); 556 if (mp != NULL) { 557 mp->b_datap->db_type = M_CTL; 558 mp->b_wptr += sizeof (ipsec_info_t); 559 kso = (keysock_out_t *)mp->b_rptr; 560 kso->ks_out_type = KEYSOCK_OUT; 561 kso->ks_out_len = sizeof (*kso); 562 kso->ks_out_serial = serial; 563 } 564 565 return (mp); 566 } 567 568 /* 569 * Perform an SADB_DUMP, spewing out every SA in an array of SA fanouts 570 * to keysock. 571 */ 572 static int 573 sadb_dump_fanout(queue_t *pfkey_q, mblk_t *mp, minor_t serial, isaf_t *fanout, 574 int num_entries, boolean_t do_peers, time_t active_time) 575 { 576 int i, error = 0; 577 mblk_t *original_answer; 578 ipsa_t *walker; 579 sadb_msg_t *samsg; 580 time_t current; 581 582 /* 583 * For each IPSA hash bucket do: 584 * - Hold the mutex 585 * - Walk each entry, doing an sadb_dump_deliver() on it. 586 */ 587 ASSERT(mp->b_cont != NULL); 588 samsg = (sadb_msg_t *)mp->b_cont->b_rptr; 589 590 original_answer = sadb_keysock_out(serial); 591 if (original_answer == NULL) 592 return (ENOMEM); 593 594 current = gethrestime_sec(); 595 for (i = 0; i < num_entries; i++) { 596 mutex_enter(&fanout[i].isaf_lock); 597 for (walker = fanout[i].isaf_ipsa; walker != NULL; 598 walker = walker->ipsa_next) { 599 if (!do_peers && walker->ipsa_haspeer) 600 continue; 601 if ((active_time != 0) && 602 ((current - walker->ipsa_lastuse) > active_time)) 603 continue; 604 error = sadb_dump_deliver(pfkey_q, original_answer, 605 walker, samsg); 606 if (error == ENOBUFS) { 607 mblk_t *new_original_answer; 608 609 /* Ran out of dupb's. Try a copyb. */ 610 new_original_answer = copyb(original_answer); 611 if (new_original_answer == NULL) { 612 error = ENOMEM; 613 } else { 614 freeb(original_answer); 615 original_answer = new_original_answer; 616 error = sadb_dump_deliver(pfkey_q, 617 original_answer, walker, samsg); 618 } 619 } 620 if (error != 0) 621 break; /* out of for loop. */ 622 } 623 mutex_exit(&fanout[i].isaf_lock); 624 if (error != 0) 625 break; /* out of for loop. */ 626 } 627 628 freeb(original_answer); 629 return (error); 630 } 631 632 /* 633 * Dump an entire SADB; outbound first, then inbound. 634 */ 635 636 int 637 sadb_dump(queue_t *pfkey_q, mblk_t *mp, keysock_in_t *ksi, sadb_t *sp) 638 { 639 int error; 640 time_t active_time = 0; 641 sadb_x_edump_t *edump = 642 (sadb_x_edump_t *)ksi->ks_in_extv[SADB_X_EXT_EDUMP]; 643 644 if (edump != NULL) { 645 active_time = edump->sadb_x_edump_timeout; 646 } 647 648 /* Dump outbound */ 649 error = sadb_dump_fanout(pfkey_q, mp, ksi->ks_in_serial, sp->sdb_of, 650 sp->sdb_hashsize, B_TRUE, active_time); 651 if (error) 652 return (error); 653 654 /* Dump inbound */ 655 return sadb_dump_fanout(pfkey_q, mp, ksi->ks_in_serial, sp->sdb_if, 656 sp->sdb_hashsize, B_FALSE, active_time); 657 } 658 659 /* 660 * Generic sadb table walker. 661 * 662 * Call "walkfn" for each SA in each bucket in "table"; pass the 663 * bucket, the entry and "cookie" to the callback function. 664 * Take care to ensure that walkfn can delete the SA without screwing 665 * up our traverse. 666 * 667 * The bucket is locked for the duration of the callback, both so that the 668 * callback can just call sadb_unlinkassoc() when it wants to delete something, 669 * and so that no new entries are added while we're walking the list. 670 */ 671 static void 672 sadb_walker(isaf_t *table, uint_t numentries, 673 void (*walkfn)(isaf_t *head, ipsa_t *entry, void *cookie), 674 void *cookie) 675 { 676 int i; 677 for (i = 0; i < numentries; i++) { 678 ipsa_t *entry, *next; 679 680 mutex_enter(&table[i].isaf_lock); 681 682 for (entry = table[i].isaf_ipsa; entry != NULL; 683 entry = next) { 684 next = entry->ipsa_next; 685 (*walkfn)(&table[i], entry, cookie); 686 } 687 mutex_exit(&table[i].isaf_lock); 688 } 689 } 690 691 /* 692 * From the given SA, construct a dl_ct_ipsec_key and 693 * a dl_ct_ipsec structures to be sent to the adapter as part 694 * of a DL_CONTROL_REQ. 695 * 696 * ct_sa must point to the storage allocated for the key 697 * structure and must be followed by storage allocated 698 * for the SA information that must be sent to the driver 699 * as part of the DL_CONTROL_REQ request. 700 * 701 * The is_inbound boolean indicates whether the specified 702 * SA is part of an inbound SA table. 703 * 704 * Returns B_TRUE if the corresponding SA must be passed to 705 * a provider, B_FALSE otherwise; frees *mp if it returns B_FALSE. 706 */ 707 static boolean_t 708 sadb_req_from_sa(ipsa_t *sa, mblk_t *mp, boolean_t is_inbound) 709 { 710 dl_ct_ipsec_key_t *keyp; 711 dl_ct_ipsec_t *sap; 712 void *ct_sa = mp->b_wptr; 713 714 ASSERT(MUTEX_HELD(&sa->ipsa_lock)); 715 716 keyp = (dl_ct_ipsec_key_t *)(ct_sa); 717 sap = (dl_ct_ipsec_t *)(keyp + 1); 718 719 IPSECHW_DEBUG(IPSECHW_CAPAB, ("sadb_req_from_sa: " 720 "is_inbound = %d\n", is_inbound)); 721 722 /* initialize flag */ 723 sap->sadb_sa_flags = 0; 724 if (is_inbound) { 725 sap->sadb_sa_flags |= DL_CT_IPSEC_INBOUND; 726 /* 727 * If an inbound SA has a peer, then mark it has being 728 * an outbound SA as well. 729 */ 730 if (sa->ipsa_haspeer) 731 sap->sadb_sa_flags |= DL_CT_IPSEC_OUTBOUND; 732 } else { 733 /* 734 * If an outbound SA has a peer, then don't send it, 735 * since we will send the copy from the inbound table. 736 */ 737 if (sa->ipsa_haspeer) { 738 freemsg(mp); 739 return (B_FALSE); 740 } 741 sap->sadb_sa_flags |= DL_CT_IPSEC_OUTBOUND; 742 } 743 744 keyp->dl_key_spi = sa->ipsa_spi; 745 bcopy(sa->ipsa_dstaddr, keyp->dl_key_dest_addr, 746 DL_CTL_IPSEC_ADDR_LEN); 747 keyp->dl_key_addr_family = sa->ipsa_addrfam; 748 749 sap->sadb_sa_auth = sa->ipsa_auth_alg; 750 sap->sadb_sa_encrypt = sa->ipsa_encr_alg; 751 752 sap->sadb_key_len_a = sa->ipsa_authkeylen; 753 sap->sadb_key_bits_a = sa->ipsa_authkeybits; 754 bcopy(sa->ipsa_authkey, 755 sap->sadb_key_data_a, sap->sadb_key_len_a); 756 757 sap->sadb_key_len_e = sa->ipsa_encrkeylen; 758 sap->sadb_key_bits_e = sa->ipsa_encrkeybits; 759 bcopy(sa->ipsa_encrkey, 760 sap->sadb_key_data_e, sap->sadb_key_len_e); 761 762 mp->b_wptr += sizeof (dl_ct_ipsec_t) + sizeof (dl_ct_ipsec_key_t); 763 return (B_TRUE); 764 } 765 766 /* 767 * Called from AH or ESP to format a message which will be used to inform 768 * IPsec-acceleration-capable ills of a SADB change. 769 * (It is not possible to send the message to IP directly from this function 770 * since the SA, if any, is locked during the call). 771 * 772 * dl_operation: DL_CONTROL_REQ operation (add, delete, update, etc) 773 * sa_type: identifies whether the operation applies to AH or ESP 774 * (must be one of SADB_SATYPE_AH or SADB_SATYPE_ESP) 775 * sa: Pointer to an SA. Must be non-NULL and locked 776 * for ADD, DELETE, GET, and UPDATE operations. 777 * This function returns an mblk chain that must be passed to IP 778 * for forwarding to the IPsec capable providers. 779 */ 780 mblk_t * 781 sadb_fmt_sa_req(uint_t dl_operation, uint_t sa_type, ipsa_t *sa, 782 boolean_t is_inbound) 783 { 784 mblk_t *mp; 785 dl_control_req_t *ctrl; 786 boolean_t need_key = B_FALSE; 787 mblk_t *ctl_mp = NULL; 788 ipsec_ctl_t *ctl; 789 790 /* 791 * 1 allocate and initialize DL_CONTROL_REQ M_PROTO 792 * 2 if a key is needed for the operation 793 * 2.1 initialize key 794 * 2.2 if a full SA is needed for the operation 795 * 2.2.1 initialize full SA info 796 * 3 return message; caller will call ill_ipsec_capab_send_all() 797 * to send the resulting message to IPsec capable ills. 798 */ 799 800 ASSERT(sa_type == SADB_SATYPE_AH || sa_type == SADB_SATYPE_ESP); 801 802 /* 803 * Allocate DL_CONTROL_REQ M_PROTO 804 * We allocate room for the SA even if it's not needed 805 * by some of the operations (for example flush) 806 */ 807 mp = allocb(sizeof (dl_control_req_t) + 808 sizeof (dl_ct_ipsec_key_t) + sizeof (dl_ct_ipsec_t), BPRI_HI); 809 if (mp == NULL) 810 return (NULL); 811 mp->b_datap->db_type = M_PROTO; 812 813 /* initialize dl_control_req_t */ 814 ctrl = (dl_control_req_t *)mp->b_wptr; 815 ctrl->dl_primitive = DL_CONTROL_REQ; 816 ctrl->dl_operation = dl_operation; 817 ctrl->dl_type = sa_type == SADB_SATYPE_AH ? DL_CT_IPSEC_AH : 818 DL_CT_IPSEC_ESP; 819 ctrl->dl_key_offset = sizeof (dl_control_req_t); 820 ctrl->dl_key_length = sizeof (dl_ct_ipsec_key_t); 821 ctrl->dl_data_offset = sizeof (dl_control_req_t) + 822 sizeof (dl_ct_ipsec_key_t); 823 ctrl->dl_data_length = sizeof (dl_ct_ipsec_t); 824 mp->b_wptr += sizeof (dl_control_req_t); 825 826 if ((dl_operation == DL_CO_SET) || (dl_operation == DL_CO_DELETE)) { 827 ASSERT(sa != NULL); 828 ASSERT(MUTEX_HELD(&sa->ipsa_lock)); 829 830 need_key = B_TRUE; 831 832 /* 833 * Initialize key and SA data. Note that for some 834 * operations the SA data is ignored by the provider 835 * (delete, etc.) 836 */ 837 if (!sadb_req_from_sa(sa, mp, is_inbound)) 838 return (NULL); 839 } 840 841 /* construct control message */ 842 ctl_mp = allocb(sizeof (ipsec_ctl_t), BPRI_HI); 843 if (ctl_mp == NULL) { 844 cmn_err(CE_WARN, "sadb_fmt_sa_req: allocb failed\n"); 845 freemsg(mp); 846 return (NULL); 847 } 848 849 ctl_mp->b_datap->db_type = M_CTL; 850 ctl_mp->b_wptr += sizeof (ipsec_ctl_t); 851 ctl_mp->b_cont = mp; 852 853 ctl = (ipsec_ctl_t *)ctl_mp->b_rptr; 854 ctl->ipsec_ctl_type = IPSEC_CTL; 855 ctl->ipsec_ctl_len = sizeof (ipsec_ctl_t); 856 ctl->ipsec_ctl_sa_type = sa_type; 857 858 if (need_key) { 859 /* 860 * Keep an additional reference on SA, since it will be 861 * needed by IP to send control messages corresponding 862 * to that SA from its perimeter. IP will do a 863 * IPSA_REFRELE when done with the request. 864 */ 865 ASSERT(MUTEX_HELD(&sa->ipsa_lock)); 866 IPSA_REFHOLD(sa); 867 ctl->ipsec_ctl_sa = sa; 868 } else 869 ctl->ipsec_ctl_sa = NULL; 870 871 return (ctl_mp); 872 } 873 874 875 /* 876 * Called by sadb_ill_download() to dump the entries for a specific 877 * fanout table. For each SA entry in the table passed as argument, 878 * use mp as a template and constructs a full DL_CONTROL message, and 879 * call ill_dlpi_send(), provided by IP, to send the resulting 880 * messages to the ill. 881 */ 882 static void 883 sadb_ill_df(ill_t *ill, mblk_t *mp, isaf_t *fanout, int num_entries, 884 boolean_t is_inbound) 885 { 886 ipsa_t *walker; 887 mblk_t *nmp, *salist; 888 int i, error = 0; 889 ip_stack_t *ipst = ill->ill_ipst; 890 netstack_t *ns = ipst->ips_netstack; 891 892 IPSECHW_DEBUG(IPSECHW_SADB, ("sadb_ill_df: fanout at 0x%p ne=%d\n", 893 (void *)fanout, num_entries)); 894 /* 895 * For each IPSA hash bucket do: 896 * - Hold the mutex 897 * - Walk each entry, sending a corresponding request to IP 898 * for it. 899 */ 900 ASSERT(mp->b_datap->db_type == M_PROTO); 901 902 for (i = 0; i < num_entries; i++) { 903 mutex_enter(&fanout[i].isaf_lock); 904 salist = NULL; 905 906 for (walker = fanout[i].isaf_ipsa; walker != NULL; 907 walker = walker->ipsa_next) { 908 IPSECHW_DEBUG(IPSECHW_SADB, 909 ("sadb_ill_df: sending SA to ill via IP \n")); 910 /* 911 * Duplicate the template mp passed and 912 * complete DL_CONTROL_REQ data. 913 * To be more memory efficient, we could use 914 * dupb() for the M_CTL and copyb() for the M_PROTO 915 * as the M_CTL, since the M_CTL is the same for 916 * every SA entry passed down to IP for the same ill. 917 * 918 * Note that copymsg/copyb ensure that the new mblk 919 * is at least as large as the source mblk even if it's 920 * not using all its storage -- therefore, nmp 921 * has trailing space for sadb_req_from_sa to add 922 * the SA-specific bits. 923 */ 924 mutex_enter(&walker->ipsa_lock); 925 if (ipsec_capab_match(ill, 926 ill->ill_phyint->phyint_ifindex, ill->ill_isv6, 927 walker, ns)) { 928 nmp = copymsg(mp); 929 if (nmp == NULL) { 930 IPSECHW_DEBUG(IPSECHW_SADB, 931 ("sadb_ill_df: alloc error\n")); 932 error = ENOMEM; 933 mutex_exit(&walker->ipsa_lock); 934 break; 935 } 936 if (sadb_req_from_sa(walker, nmp, is_inbound)) { 937 nmp->b_next = salist; 938 salist = nmp; 939 } 940 } 941 mutex_exit(&walker->ipsa_lock); 942 } 943 mutex_exit(&fanout[i].isaf_lock); 944 while (salist != NULL) { 945 nmp = salist; 946 salist = nmp->b_next; 947 nmp->b_next = NULL; 948 ill_dlpi_send(ill, nmp); 949 } 950 if (error != 0) 951 break; /* out of for loop. */ 952 } 953 } 954 955 /* 956 * Called by ill_ipsec_capab_add(). Sends a copy of the SADB of 957 * the type specified by sa_type to the specified ill. 958 * 959 * We call for each fanout table defined by the SADB (one per 960 * protocol). sadb_ill_df() finally calls ill_dlpi_send() for 961 * each SADB entry in order to send a corresponding DL_CONTROL_REQ 962 * message to the ill. 963 */ 964 void 965 sadb_ill_download(ill_t *ill, uint_t sa_type) 966 { 967 mblk_t *protomp; /* prototype message */ 968 dl_control_req_t *ctrl; 969 sadbp_t *spp; 970 sadb_t *sp; 971 int dlt; 972 ip_stack_t *ipst = ill->ill_ipst; 973 netstack_t *ns = ipst->ips_netstack; 974 975 ASSERT(sa_type == SADB_SATYPE_AH || sa_type == SADB_SATYPE_ESP); 976 977 /* 978 * Allocate and initialize prototype answer. A duplicate for 979 * each SA is sent down to the interface. 980 */ 981 982 /* DL_CONTROL_REQ M_PROTO mblk_t */ 983 protomp = allocb(sizeof (dl_control_req_t) + 984 sizeof (dl_ct_ipsec_key_t) + sizeof (dl_ct_ipsec_t), BPRI_HI); 985 if (protomp == NULL) 986 return; 987 protomp->b_datap->db_type = M_PROTO; 988 989 dlt = (sa_type == SADB_SATYPE_AH) ? DL_CT_IPSEC_AH : DL_CT_IPSEC_ESP; 990 if (sa_type == SADB_SATYPE_ESP) { 991 ipsecesp_stack_t *espstack = ns->netstack_ipsecesp; 992 993 spp = &espstack->esp_sadb; 994 } else { 995 ipsecah_stack_t *ahstack = ns->netstack_ipsecah; 996 997 spp = &ahstack->ah_sadb; 998 } 999 1000 ctrl = (dl_control_req_t *)protomp->b_wptr; 1001 ctrl->dl_primitive = DL_CONTROL_REQ; 1002 ctrl->dl_operation = DL_CO_SET; 1003 ctrl->dl_type = dlt; 1004 ctrl->dl_key_offset = sizeof (dl_control_req_t); 1005 ctrl->dl_key_length = sizeof (dl_ct_ipsec_key_t); 1006 ctrl->dl_data_offset = sizeof (dl_control_req_t) + 1007 sizeof (dl_ct_ipsec_key_t); 1008 ctrl->dl_data_length = sizeof (dl_ct_ipsec_t); 1009 protomp->b_wptr += sizeof (dl_control_req_t); 1010 1011 /* 1012 * then for each SADB entry, we fill out the dl_ct_ipsec_key_t 1013 * and dl_ct_ipsec_t 1014 */ 1015 sp = ill->ill_isv6 ? &(spp->s_v6) : &(spp->s_v4); 1016 sadb_ill_df(ill, protomp, sp->sdb_of, sp->sdb_hashsize, B_FALSE); 1017 sadb_ill_df(ill, protomp, sp->sdb_if, sp->sdb_hashsize, B_TRUE); 1018 freemsg(protomp); 1019 } 1020 1021 /* 1022 * Call me to free up a security association fanout. Use the forever 1023 * variable to indicate freeing up the SAs (forever == B_FALSE, e.g. 1024 * an SADB_FLUSH message), or destroying everything (forever == B_TRUE, 1025 * when a module is unloaded). 1026 */ 1027 static void 1028 sadb_destroyer(isaf_t **tablep, uint_t numentries, boolean_t forever, 1029 boolean_t inbound) 1030 { 1031 int i; 1032 isaf_t *table = *tablep; 1033 uint8_t protocol; 1034 ipsa_t *sa; 1035 netstackid_t sid; 1036 1037 if (table == NULL) 1038 return; 1039 1040 for (i = 0; i < numentries; i++) { 1041 mutex_enter(&table[i].isaf_lock); 1042 while ((sa = table[i].isaf_ipsa) != NULL) { 1043 if (inbound && cl_inet_deletespi && 1044 (sa->ipsa_state != IPSA_STATE_ACTIVE_ELSEWHERE) && 1045 (sa->ipsa_state != IPSA_STATE_IDLE)) { 1046 protocol = (sa->ipsa_type == SADB_SATYPE_AH) ? 1047 IPPROTO_AH : IPPROTO_ESP; 1048 sid = sa->ipsa_netstack->netstack_stackid; 1049 cl_inet_deletespi(sid, protocol, sa->ipsa_spi, 1050 NULL); 1051 } 1052 sadb_unlinkassoc(sa); 1053 } 1054 table[i].isaf_gen++; 1055 mutex_exit(&table[i].isaf_lock); 1056 if (forever) 1057 mutex_destroy(&(table[i].isaf_lock)); 1058 } 1059 1060 if (forever) { 1061 *tablep = NULL; 1062 kmem_free(table, numentries * sizeof (*table)); 1063 } 1064 } 1065 1066 /* 1067 * Entry points to sadb_destroyer(). 1068 */ 1069 static void 1070 sadb_flush(sadb_t *sp, netstack_t *ns) 1071 { 1072 /* 1073 * Flush out each bucket, one at a time. Were it not for keysock's 1074 * enforcement, there would be a subtlety where I could add on the 1075 * heels of a flush. With keysock's enforcement, however, this 1076 * makes ESP's job easy. 1077 */ 1078 sadb_destroyer(&sp->sdb_of, sp->sdb_hashsize, B_FALSE, B_FALSE); 1079 sadb_destroyer(&sp->sdb_if, sp->sdb_hashsize, B_FALSE, B_TRUE); 1080 1081 /* For each acquire, destroy it; leave the bucket mutex alone. */ 1082 sadb_destroy_acqlist(&sp->sdb_acq, sp->sdb_hashsize, B_FALSE, ns); 1083 } 1084 1085 static void 1086 sadb_destroy(sadb_t *sp, netstack_t *ns) 1087 { 1088 sadb_destroyer(&sp->sdb_of, sp->sdb_hashsize, B_TRUE, B_FALSE); 1089 sadb_destroyer(&sp->sdb_if, sp->sdb_hashsize, B_TRUE, B_TRUE); 1090 1091 /* For each acquire, destroy it, including the bucket mutex. */ 1092 sadb_destroy_acqlist(&sp->sdb_acq, sp->sdb_hashsize, B_TRUE, ns); 1093 1094 ASSERT(sp->sdb_of == NULL); 1095 ASSERT(sp->sdb_if == NULL); 1096 ASSERT(sp->sdb_acq == NULL); 1097 } 1098 1099 static void 1100 sadb_send_flush_req(sadbp_t *spp) 1101 { 1102 mblk_t *ctl_mp; 1103 1104 /* 1105 * we've been unplumbed, or never were plumbed; don't go there. 1106 */ 1107 if (spp->s_ip_q == NULL) 1108 return; 1109 1110 /* have IP send a flush msg to the IPsec accelerators */ 1111 ctl_mp = sadb_fmt_sa_req(DL_CO_FLUSH, spp->s_satype, NULL, B_TRUE); 1112 if (ctl_mp != NULL) 1113 putnext(spp->s_ip_q, ctl_mp); 1114 } 1115 1116 void 1117 sadbp_flush(sadbp_t *spp, netstack_t *ns) 1118 { 1119 sadb_flush(&spp->s_v4, ns); 1120 sadb_flush(&spp->s_v6, ns); 1121 1122 sadb_send_flush_req(spp); 1123 } 1124 1125 void 1126 sadbp_destroy(sadbp_t *spp, netstack_t *ns) 1127 { 1128 sadb_destroy(&spp->s_v4, ns); 1129 sadb_destroy(&spp->s_v6, ns); 1130 1131 sadb_send_flush_req(spp); 1132 if (spp->s_satype == SADB_SATYPE_AH) { 1133 ipsec_stack_t *ipss = ns->netstack_ipsec; 1134 1135 ip_drop_unregister(&ipss->ipsec_sadb_dropper); 1136 } 1137 } 1138 1139 1140 /* 1141 * Check hard vs. soft lifetimes. If there's a reality mismatch (e.g. 1142 * soft lifetimes > hard lifetimes) return an appropriate diagnostic for 1143 * EINVAL. 1144 */ 1145 int 1146 sadb_hardsoftchk(sadb_lifetime_t *hard, sadb_lifetime_t *soft, 1147 sadb_lifetime_t *idle) 1148 { 1149 if (hard == NULL || soft == NULL) 1150 return (0); 1151 1152 if (hard->sadb_lifetime_allocations != 0 && 1153 soft->sadb_lifetime_allocations != 0 && 1154 hard->sadb_lifetime_allocations < soft->sadb_lifetime_allocations) 1155 return (SADB_X_DIAGNOSTIC_ALLOC_HSERR); 1156 1157 if (hard->sadb_lifetime_bytes != 0 && 1158 soft->sadb_lifetime_bytes != 0 && 1159 hard->sadb_lifetime_bytes < soft->sadb_lifetime_bytes) 1160 return (SADB_X_DIAGNOSTIC_BYTES_HSERR); 1161 1162 if (hard->sadb_lifetime_addtime != 0 && 1163 soft->sadb_lifetime_addtime != 0 && 1164 hard->sadb_lifetime_addtime < soft->sadb_lifetime_addtime) 1165 return (SADB_X_DIAGNOSTIC_ADDTIME_HSERR); 1166 1167 if (hard->sadb_lifetime_usetime != 0 && 1168 soft->sadb_lifetime_usetime != 0 && 1169 hard->sadb_lifetime_usetime < soft->sadb_lifetime_usetime) 1170 return (SADB_X_DIAGNOSTIC_USETIME_HSERR); 1171 1172 if (idle != NULL) { 1173 if (hard->sadb_lifetime_addtime != 0 && 1174 idle->sadb_lifetime_addtime != 0 && 1175 hard->sadb_lifetime_addtime < idle->sadb_lifetime_addtime) 1176 return (SADB_X_DIAGNOSTIC_ADDTIME_HSERR); 1177 1178 if (soft->sadb_lifetime_addtime != 0 && 1179 idle->sadb_lifetime_addtime != 0 && 1180 soft->sadb_lifetime_addtime < idle->sadb_lifetime_addtime) 1181 return (SADB_X_DIAGNOSTIC_ADDTIME_HSERR); 1182 1183 if (hard->sadb_lifetime_usetime != 0 && 1184 idle->sadb_lifetime_usetime != 0 && 1185 hard->sadb_lifetime_usetime < idle->sadb_lifetime_usetime) 1186 return (SADB_X_DIAGNOSTIC_USETIME_HSERR); 1187 1188 if (soft->sadb_lifetime_usetime != 0 && 1189 idle->sadb_lifetime_usetime != 0 && 1190 soft->sadb_lifetime_usetime < idle->sadb_lifetime_usetime) 1191 return (SADB_X_DIAGNOSTIC_USETIME_HSERR); 1192 } 1193 1194 return (0); 1195 } 1196 1197 /* 1198 * Clone a security association for the purposes of inserting a single SA 1199 * into inbound and outbound tables respectively. This function should only 1200 * be called from sadb_common_add(). 1201 */ 1202 static ipsa_t * 1203 sadb_cloneassoc(ipsa_t *ipsa) 1204 { 1205 ipsa_t *newbie; 1206 boolean_t error = B_FALSE; 1207 1208 ASSERT(MUTEX_NOT_HELD(&(ipsa->ipsa_lock))); 1209 1210 newbie = kmem_alloc(sizeof (ipsa_t), KM_NOSLEEP); 1211 if (newbie == NULL) 1212 return (NULL); 1213 1214 /* Copy over what we can. */ 1215 *newbie = *ipsa; 1216 1217 /* bzero and initialize locks, in case *_init() allocates... */ 1218 mutex_init(&newbie->ipsa_lock, NULL, MUTEX_DEFAULT, NULL); 1219 1220 /* 1221 * While somewhat dain-bramaged, the most graceful way to 1222 * recover from errors is to keep plowing through the 1223 * allocations, and getting what I can. It's easier to call 1224 * sadb_freeassoc() on the stillborn clone when all the 1225 * pointers aren't pointing to the parent's data. 1226 */ 1227 1228 if (ipsa->ipsa_authkey != NULL) { 1229 newbie->ipsa_authkey = kmem_alloc(newbie->ipsa_authkeylen, 1230 KM_NOSLEEP); 1231 if (newbie->ipsa_authkey == NULL) { 1232 error = B_TRUE; 1233 } else { 1234 bcopy(ipsa->ipsa_authkey, newbie->ipsa_authkey, 1235 newbie->ipsa_authkeylen); 1236 1237 newbie->ipsa_kcfauthkey.ck_data = 1238 newbie->ipsa_authkey; 1239 } 1240 1241 if (newbie->ipsa_amech.cm_param != NULL) { 1242 newbie->ipsa_amech.cm_param = 1243 (char *)&newbie->ipsa_mac_len; 1244 } 1245 } 1246 1247 if (ipsa->ipsa_encrkey != NULL) { 1248 newbie->ipsa_encrkey = kmem_alloc(newbie->ipsa_encrkeylen, 1249 KM_NOSLEEP); 1250 if (newbie->ipsa_encrkey == NULL) { 1251 error = B_TRUE; 1252 } else { 1253 bcopy(ipsa->ipsa_encrkey, newbie->ipsa_encrkey, 1254 newbie->ipsa_encrkeylen); 1255 1256 newbie->ipsa_kcfencrkey.ck_data = 1257 newbie->ipsa_encrkey; 1258 } 1259 } 1260 1261 newbie->ipsa_authtmpl = NULL; 1262 newbie->ipsa_encrtmpl = NULL; 1263 newbie->ipsa_haspeer = B_TRUE; 1264 1265 if (ipsa->ipsa_integ != NULL) { 1266 newbie->ipsa_integ = kmem_alloc(newbie->ipsa_integlen, 1267 KM_NOSLEEP); 1268 if (newbie->ipsa_integ == NULL) { 1269 error = B_TRUE; 1270 } else { 1271 bcopy(ipsa->ipsa_integ, newbie->ipsa_integ, 1272 newbie->ipsa_integlen); 1273 } 1274 } 1275 1276 if (ipsa->ipsa_sens != NULL) { 1277 newbie->ipsa_sens = kmem_alloc(newbie->ipsa_senslen, 1278 KM_NOSLEEP); 1279 if (newbie->ipsa_sens == NULL) { 1280 error = B_TRUE; 1281 } else { 1282 bcopy(ipsa->ipsa_sens, newbie->ipsa_sens, 1283 newbie->ipsa_senslen); 1284 } 1285 } 1286 1287 if (ipsa->ipsa_src_cid != NULL) { 1288 newbie->ipsa_src_cid = ipsa->ipsa_src_cid; 1289 IPSID_REFHOLD(ipsa->ipsa_src_cid); 1290 } 1291 1292 if (ipsa->ipsa_dst_cid != NULL) { 1293 newbie->ipsa_dst_cid = ipsa->ipsa_dst_cid; 1294 IPSID_REFHOLD(ipsa->ipsa_dst_cid); 1295 } 1296 1297 if (error) { 1298 sadb_freeassoc(newbie); 1299 return (NULL); 1300 } 1301 1302 return (newbie); 1303 } 1304 1305 /* 1306 * Initialize a SADB address extension at the address specified by addrext. 1307 * Return a pointer to the end of the new address extension. 1308 */ 1309 static uint8_t * 1310 sadb_make_addr_ext(uint8_t *start, uint8_t *end, uint16_t exttype, 1311 sa_family_t af, uint32_t *addr, uint16_t port, uint8_t proto, int prefix) 1312 { 1313 struct sockaddr_in *sin; 1314 struct sockaddr_in6 *sin6; 1315 uint8_t *cur = start; 1316 int addrext_len; 1317 int sin_len; 1318 sadb_address_t *addrext = (sadb_address_t *)cur; 1319 1320 if (cur == NULL) 1321 return (NULL); 1322 1323 cur += sizeof (*addrext); 1324 if (cur > end) 1325 return (NULL); 1326 1327 addrext->sadb_address_proto = proto; 1328 addrext->sadb_address_prefixlen = prefix; 1329 addrext->sadb_address_reserved = 0; 1330 addrext->sadb_address_exttype = exttype; 1331 1332 switch (af) { 1333 case AF_INET: 1334 sin = (struct sockaddr_in *)cur; 1335 sin_len = sizeof (*sin); 1336 cur += sin_len; 1337 if (cur > end) 1338 return (NULL); 1339 1340 sin->sin_family = af; 1341 bzero(sin->sin_zero, sizeof (sin->sin_zero)); 1342 sin->sin_port = port; 1343 IPSA_COPY_ADDR(&sin->sin_addr, addr, af); 1344 break; 1345 case AF_INET6: 1346 sin6 = (struct sockaddr_in6 *)cur; 1347 sin_len = sizeof (*sin6); 1348 cur += sin_len; 1349 if (cur > end) 1350 return (NULL); 1351 1352 bzero(sin6, sizeof (*sin6)); 1353 sin6->sin6_family = af; 1354 sin6->sin6_port = port; 1355 IPSA_COPY_ADDR(&sin6->sin6_addr, addr, af); 1356 break; 1357 } 1358 1359 addrext_len = roundup(cur - start, sizeof (uint64_t)); 1360 addrext->sadb_address_len = SADB_8TO64(addrext_len); 1361 1362 cur = start + addrext_len; 1363 if (cur > end) 1364 cur = NULL; 1365 1366 return (cur); 1367 } 1368 1369 /* 1370 * Construct a key management cookie extension. 1371 */ 1372 1373 static uint8_t * 1374 sadb_make_kmc_ext(uint8_t *cur, uint8_t *end, uint32_t kmp, uint32_t kmc) 1375 { 1376 sadb_x_kmc_t *kmcext = (sadb_x_kmc_t *)cur; 1377 1378 if (cur == NULL) 1379 return (NULL); 1380 1381 cur += sizeof (*kmcext); 1382 1383 if (cur > end) 1384 return (NULL); 1385 1386 kmcext->sadb_x_kmc_len = SADB_8TO64(sizeof (*kmcext)); 1387 kmcext->sadb_x_kmc_exttype = SADB_X_EXT_KM_COOKIE; 1388 kmcext->sadb_x_kmc_proto = kmp; 1389 kmcext->sadb_x_kmc_cookie = kmc; 1390 kmcext->sadb_x_kmc_reserved = 0; 1391 1392 return (cur); 1393 } 1394 1395 /* 1396 * Given an original message header with sufficient space following it, and an 1397 * SA, construct a full PF_KEY message with all of the relevant extensions. 1398 * This is mostly used for SADB_GET, and SADB_DUMP. 1399 */ 1400 static mblk_t * 1401 sadb_sa2msg(ipsa_t *ipsa, sadb_msg_t *samsg) 1402 { 1403 int alloclen, addrsize, paddrsize, authsize, encrsize; 1404 int srcidsize, dstidsize; 1405 sa_family_t fam, pfam; /* Address family for SADB_EXT_ADDRESS */ 1406 /* src/dst and proxy sockaddrs. */ 1407 /* 1408 * The following are pointers into the PF_KEY message this PF_KEY 1409 * message creates. 1410 */ 1411 sadb_msg_t *newsamsg; 1412 sadb_sa_t *assoc; 1413 sadb_lifetime_t *lt; 1414 sadb_key_t *key; 1415 sadb_ident_t *ident; 1416 sadb_sens_t *sens; 1417 sadb_ext_t *walker; /* For when we need a generic ext. pointer. */ 1418 sadb_x_replay_ctr_t *repl_ctr; 1419 sadb_x_pair_t *pair_ext; 1420 1421 mblk_t *mp; 1422 uint64_t *bitmap; 1423 uint8_t *cur, *end; 1424 /* These indicate the presence of the above extension fields. */ 1425 boolean_t soft, hard, isrc, idst, auth, encr, sensinteg, srcid, dstid; 1426 boolean_t idle; 1427 boolean_t paired; 1428 uint32_t otherspi; 1429 1430 /* First off, figure out the allocation length for this message. */ 1431 1432 /* 1433 * Constant stuff. This includes base, SA, address (src, dst), 1434 * and lifetime (current). 1435 */ 1436 alloclen = sizeof (sadb_msg_t) + sizeof (sadb_sa_t) + 1437 sizeof (sadb_lifetime_t); 1438 1439 fam = ipsa->ipsa_addrfam; 1440 switch (fam) { 1441 case AF_INET: 1442 addrsize = roundup(sizeof (struct sockaddr_in) + 1443 sizeof (sadb_address_t), sizeof (uint64_t)); 1444 break; 1445 case AF_INET6: 1446 addrsize = roundup(sizeof (struct sockaddr_in6) + 1447 sizeof (sadb_address_t), sizeof (uint64_t)); 1448 break; 1449 default: 1450 return (NULL); 1451 } 1452 /* 1453 * Allocate TWO address extensions, for source and destination. 1454 * (Thus, the * 2.) 1455 */ 1456 alloclen += addrsize * 2; 1457 if (ipsa->ipsa_flags & IPSA_F_NATT_REM) 1458 alloclen += addrsize; 1459 if (ipsa->ipsa_flags & IPSA_F_NATT_LOC) 1460 alloclen += addrsize; 1461 1462 if (ipsa->ipsa_flags & IPSA_F_PAIRED) { 1463 paired = B_TRUE; 1464 alloclen += sizeof (sadb_x_pair_t); 1465 otherspi = ipsa->ipsa_otherspi; 1466 } else { 1467 paired = B_FALSE; 1468 } 1469 1470 /* How 'bout other lifetimes? */ 1471 if (ipsa->ipsa_softaddlt != 0 || ipsa->ipsa_softuselt != 0 || 1472 ipsa->ipsa_softbyteslt != 0 || ipsa->ipsa_softalloc != 0) { 1473 alloclen += sizeof (sadb_lifetime_t); 1474 soft = B_TRUE; 1475 } else { 1476 soft = B_FALSE; 1477 } 1478 1479 if (ipsa->ipsa_hardaddlt != 0 || ipsa->ipsa_harduselt != 0 || 1480 ipsa->ipsa_hardbyteslt != 0 || ipsa->ipsa_hardalloc != 0) { 1481 alloclen += sizeof (sadb_lifetime_t); 1482 hard = B_TRUE; 1483 } else { 1484 hard = B_FALSE; 1485 } 1486 1487 if (ipsa->ipsa_idleaddlt != 0 || ipsa->ipsa_idleuselt != 0) { 1488 alloclen += sizeof (sadb_lifetime_t); 1489 idle = B_TRUE; 1490 } else { 1491 idle = B_FALSE; 1492 } 1493 1494 /* Inner addresses. */ 1495 if (ipsa->ipsa_innerfam == 0) { 1496 isrc = B_FALSE; 1497 idst = B_FALSE; 1498 } else { 1499 pfam = ipsa->ipsa_innerfam; 1500 switch (pfam) { 1501 case AF_INET6: 1502 paddrsize = roundup(sizeof (struct sockaddr_in6) + 1503 sizeof (sadb_address_t), sizeof (uint64_t)); 1504 break; 1505 case AF_INET: 1506 paddrsize = roundup(sizeof (struct sockaddr_in) + 1507 sizeof (sadb_address_t), sizeof (uint64_t)); 1508 break; 1509 default: 1510 cmn_err(CE_PANIC, 1511 "IPsec SADB: Proxy length failure.\n"); 1512 break; 1513 } 1514 isrc = B_TRUE; 1515 idst = B_TRUE; 1516 alloclen += 2 * paddrsize; 1517 } 1518 1519 /* For the following fields, assume that length != 0 ==> stuff */ 1520 if (ipsa->ipsa_authkeylen != 0) { 1521 authsize = roundup(sizeof (sadb_key_t) + ipsa->ipsa_authkeylen, 1522 sizeof (uint64_t)); 1523 alloclen += authsize; 1524 auth = B_TRUE; 1525 } else { 1526 auth = B_FALSE; 1527 } 1528 1529 if (ipsa->ipsa_encrkeylen != 0) { 1530 encrsize = roundup(sizeof (sadb_key_t) + ipsa->ipsa_encrkeylen, 1531 sizeof (uint64_t)); 1532 alloclen += encrsize; 1533 encr = B_TRUE; 1534 } else { 1535 encr = B_FALSE; 1536 } 1537 1538 /* No need for roundup on sens and integ. */ 1539 if (ipsa->ipsa_integlen != 0 || ipsa->ipsa_senslen != 0) { 1540 alloclen += sizeof (sadb_key_t) + ipsa->ipsa_integlen + 1541 ipsa->ipsa_senslen; 1542 sensinteg = B_TRUE; 1543 } else { 1544 sensinteg = B_FALSE; 1545 } 1546 1547 /* 1548 * Must use strlen() here for lengths. Identities use NULL 1549 * pointers to indicate their nonexistence. 1550 */ 1551 if (ipsa->ipsa_src_cid != NULL) { 1552 srcidsize = roundup(sizeof (sadb_ident_t) + 1553 strlen(ipsa->ipsa_src_cid->ipsid_cid) + 1, 1554 sizeof (uint64_t)); 1555 alloclen += srcidsize; 1556 srcid = B_TRUE; 1557 } else { 1558 srcid = B_FALSE; 1559 } 1560 1561 if (ipsa->ipsa_dst_cid != NULL) { 1562 dstidsize = roundup(sizeof (sadb_ident_t) + 1563 strlen(ipsa->ipsa_dst_cid->ipsid_cid) + 1, 1564 sizeof (uint64_t)); 1565 alloclen += dstidsize; 1566 dstid = B_TRUE; 1567 } else { 1568 dstid = B_FALSE; 1569 } 1570 1571 if ((ipsa->ipsa_kmp != 0) || (ipsa->ipsa_kmc != 0)) 1572 alloclen += sizeof (sadb_x_kmc_t); 1573 1574 if (ipsa->ipsa_replay != 0) { 1575 alloclen += sizeof (sadb_x_replay_ctr_t); 1576 } 1577 1578 /* Make sure the allocation length is a multiple of 8 bytes. */ 1579 ASSERT((alloclen & 0x7) == 0); 1580 1581 /* XXX Possibly make it esballoc, with a bzero-ing free_ftn. */ 1582 mp = allocb(alloclen, BPRI_HI); 1583 if (mp == NULL) 1584 return (NULL); 1585 1586 mp->b_wptr += alloclen; 1587 end = mp->b_wptr; 1588 newsamsg = (sadb_msg_t *)mp->b_rptr; 1589 *newsamsg = *samsg; 1590 newsamsg->sadb_msg_len = (uint16_t)SADB_8TO64(alloclen); 1591 1592 mutex_enter(&ipsa->ipsa_lock); /* Since I'm grabbing SA fields... */ 1593 1594 newsamsg->sadb_msg_satype = ipsa->ipsa_type; 1595 1596 assoc = (sadb_sa_t *)(newsamsg + 1); 1597 assoc->sadb_sa_len = SADB_8TO64(sizeof (*assoc)); 1598 assoc->sadb_sa_exttype = SADB_EXT_SA; 1599 assoc->sadb_sa_spi = ipsa->ipsa_spi; 1600 assoc->sadb_sa_replay = ipsa->ipsa_replay_wsize; 1601 assoc->sadb_sa_state = ipsa->ipsa_state; 1602 assoc->sadb_sa_auth = ipsa->ipsa_auth_alg; 1603 assoc->sadb_sa_encrypt = ipsa->ipsa_encr_alg; 1604 assoc->sadb_sa_flags = ipsa->ipsa_flags; 1605 1606 lt = (sadb_lifetime_t *)(assoc + 1); 1607 lt->sadb_lifetime_len = SADB_8TO64(sizeof (*lt)); 1608 lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_CURRENT; 1609 /* We do not support the concept. */ 1610 lt->sadb_lifetime_allocations = 0; 1611 lt->sadb_lifetime_bytes = ipsa->ipsa_bytes; 1612 lt->sadb_lifetime_addtime = ipsa->ipsa_addtime; 1613 lt->sadb_lifetime_usetime = ipsa->ipsa_usetime; 1614 1615 if (hard) { 1616 lt++; 1617 lt->sadb_lifetime_len = SADB_8TO64(sizeof (*lt)); 1618 lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD; 1619 lt->sadb_lifetime_allocations = ipsa->ipsa_hardalloc; 1620 lt->sadb_lifetime_bytes = ipsa->ipsa_hardbyteslt; 1621 lt->sadb_lifetime_addtime = ipsa->ipsa_hardaddlt; 1622 lt->sadb_lifetime_usetime = ipsa->ipsa_harduselt; 1623 } 1624 1625 if (soft) { 1626 lt++; 1627 lt->sadb_lifetime_len = SADB_8TO64(sizeof (*lt)); 1628 lt->sadb_lifetime_exttype = SADB_EXT_LIFETIME_SOFT; 1629 lt->sadb_lifetime_allocations = ipsa->ipsa_softalloc; 1630 lt->sadb_lifetime_bytes = ipsa->ipsa_softbyteslt; 1631 lt->sadb_lifetime_addtime = ipsa->ipsa_softaddlt; 1632 lt->sadb_lifetime_usetime = ipsa->ipsa_softuselt; 1633 } 1634 1635 if (idle) { 1636 lt++; 1637 lt->sadb_lifetime_len = SADB_8TO64(sizeof (*lt)); 1638 lt->sadb_lifetime_exttype = SADB_X_EXT_LIFETIME_IDLE; 1639 lt->sadb_lifetime_addtime = ipsa->ipsa_idleaddlt; 1640 lt->sadb_lifetime_usetime = ipsa->ipsa_idleuselt; 1641 } 1642 1643 cur = (uint8_t *)(lt + 1); 1644 1645 /* NOTE: Don't fill in ports here if we are a tunnel-mode SA. */ 1646 cur = sadb_make_addr_ext(cur, end, SADB_EXT_ADDRESS_SRC, fam, 1647 ipsa->ipsa_srcaddr, (!isrc && !idst) ? SA_SRCPORT(ipsa) : 0, 1648 SA_PROTO(ipsa), 0); 1649 if (cur == NULL) { 1650 freemsg(mp); 1651 mp = NULL; 1652 goto bail; 1653 } 1654 1655 cur = sadb_make_addr_ext(cur, end, SADB_EXT_ADDRESS_DST, fam, 1656 ipsa->ipsa_dstaddr, (!isrc && !idst) ? SA_DSTPORT(ipsa) : 0, 1657 SA_PROTO(ipsa), 0); 1658 if (cur == NULL) { 1659 freemsg(mp); 1660 mp = NULL; 1661 goto bail; 1662 } 1663 1664 if (ipsa->ipsa_flags & IPSA_F_NATT_LOC) { 1665 cur = sadb_make_addr_ext(cur, end, SADB_X_EXT_ADDRESS_NATT_LOC, 1666 fam, &ipsa->ipsa_natt_addr_loc, ipsa->ipsa_local_nat_port, 1667 IPPROTO_UDP, 0); 1668 if (cur == NULL) { 1669 freemsg(mp); 1670 mp = NULL; 1671 goto bail; 1672 } 1673 } 1674 1675 if (ipsa->ipsa_flags & IPSA_F_NATT_REM) { 1676 cur = sadb_make_addr_ext(cur, end, SADB_X_EXT_ADDRESS_NATT_REM, 1677 fam, &ipsa->ipsa_natt_addr_rem, ipsa->ipsa_remote_nat_port, 1678 IPPROTO_UDP, 0); 1679 if (cur == NULL) { 1680 freemsg(mp); 1681 mp = NULL; 1682 goto bail; 1683 } 1684 } 1685 1686 /* If we are a tunnel-mode SA, fill in the inner-selectors. */ 1687 if (isrc) { 1688 cur = sadb_make_addr_ext(cur, end, SADB_X_EXT_ADDRESS_INNER_SRC, 1689 pfam, ipsa->ipsa_innersrc, SA_SRCPORT(ipsa), 1690 SA_IPROTO(ipsa), ipsa->ipsa_innersrcpfx); 1691 if (cur == NULL) { 1692 freemsg(mp); 1693 mp = NULL; 1694 goto bail; 1695 } 1696 } 1697 1698 if (idst) { 1699 cur = sadb_make_addr_ext(cur, end, SADB_X_EXT_ADDRESS_INNER_DST, 1700 pfam, ipsa->ipsa_innerdst, SA_DSTPORT(ipsa), 1701 SA_IPROTO(ipsa), ipsa->ipsa_innerdstpfx); 1702 if (cur == NULL) { 1703 freemsg(mp); 1704 mp = NULL; 1705 goto bail; 1706 } 1707 } 1708 1709 if ((ipsa->ipsa_kmp != 0) || (ipsa->ipsa_kmc != 0)) { 1710 cur = sadb_make_kmc_ext(cur, end, 1711 ipsa->ipsa_kmp, ipsa->ipsa_kmc); 1712 if (cur == NULL) { 1713 freemsg(mp); 1714 mp = NULL; 1715 goto bail; 1716 } 1717 } 1718 1719 walker = (sadb_ext_t *)cur; 1720 if (auth) { 1721 key = (sadb_key_t *)walker; 1722 key->sadb_key_len = SADB_8TO64(authsize); 1723 key->sadb_key_exttype = SADB_EXT_KEY_AUTH; 1724 key->sadb_key_bits = ipsa->ipsa_authkeybits; 1725 key->sadb_key_reserved = 0; 1726 bcopy(ipsa->ipsa_authkey, key + 1, ipsa->ipsa_authkeylen); 1727 walker = (sadb_ext_t *)((uint64_t *)walker + 1728 walker->sadb_ext_len); 1729 } 1730 1731 if (encr) { 1732 key = (sadb_key_t *)walker; 1733 key->sadb_key_len = SADB_8TO64(encrsize); 1734 key->sadb_key_exttype = SADB_EXT_KEY_ENCRYPT; 1735 key->sadb_key_bits = ipsa->ipsa_encrkeybits; 1736 key->sadb_key_reserved = 0; 1737 bcopy(ipsa->ipsa_encrkey, key + 1, ipsa->ipsa_encrkeylen); 1738 walker = (sadb_ext_t *)((uint64_t *)walker + 1739 walker->sadb_ext_len); 1740 } 1741 1742 if (srcid) { 1743 ident = (sadb_ident_t *)walker; 1744 ident->sadb_ident_len = SADB_8TO64(srcidsize); 1745 ident->sadb_ident_exttype = SADB_EXT_IDENTITY_SRC; 1746 ident->sadb_ident_type = ipsa->ipsa_src_cid->ipsid_type; 1747 ident->sadb_ident_id = 0; 1748 ident->sadb_ident_reserved = 0; 1749 (void) strcpy((char *)(ident + 1), 1750 ipsa->ipsa_src_cid->ipsid_cid); 1751 walker = (sadb_ext_t *)((uint64_t *)walker + 1752 walker->sadb_ext_len); 1753 } 1754 1755 if (dstid) { 1756 ident = (sadb_ident_t *)walker; 1757 ident->sadb_ident_len = SADB_8TO64(dstidsize); 1758 ident->sadb_ident_exttype = SADB_EXT_IDENTITY_DST; 1759 ident->sadb_ident_type = ipsa->ipsa_dst_cid->ipsid_type; 1760 ident->sadb_ident_id = 0; 1761 ident->sadb_ident_reserved = 0; 1762 (void) strcpy((char *)(ident + 1), 1763 ipsa->ipsa_dst_cid->ipsid_cid); 1764 walker = (sadb_ext_t *)((uint64_t *)walker + 1765 walker->sadb_ext_len); 1766 } 1767 1768 if (sensinteg) { 1769 sens = (sadb_sens_t *)walker; 1770 sens->sadb_sens_len = SADB_8TO64(sizeof (sadb_sens_t *) + 1771 ipsa->ipsa_senslen + ipsa->ipsa_integlen); 1772 sens->sadb_sens_dpd = ipsa->ipsa_dpd; 1773 sens->sadb_sens_sens_level = ipsa->ipsa_senslevel; 1774 sens->sadb_sens_integ_level = ipsa->ipsa_integlevel; 1775 sens->sadb_sens_sens_len = SADB_8TO64(ipsa->ipsa_senslen); 1776 sens->sadb_sens_integ_len = SADB_8TO64(ipsa->ipsa_integlen); 1777 sens->sadb_sens_reserved = 0; 1778 bitmap = (uint64_t *)(sens + 1); 1779 if (ipsa->ipsa_sens != NULL) { 1780 bcopy(ipsa->ipsa_sens, bitmap, ipsa->ipsa_senslen); 1781 bitmap += sens->sadb_sens_sens_len; 1782 } 1783 if (ipsa->ipsa_integ != NULL) 1784 bcopy(ipsa->ipsa_integ, bitmap, ipsa->ipsa_integlen); 1785 walker = (sadb_ext_t *)((uint64_t *)walker + 1786 walker->sadb_ext_len); 1787 } 1788 1789 if (paired) { 1790 pair_ext = (sadb_x_pair_t *)walker; 1791 1792 pair_ext->sadb_x_pair_len = SADB_8TO64(sizeof (sadb_x_pair_t)); 1793 pair_ext->sadb_x_pair_exttype = SADB_X_EXT_PAIR; 1794 pair_ext->sadb_x_pair_spi = otherspi; 1795 1796 walker = (sadb_ext_t *)((uint64_t *)walker + 1797 walker->sadb_ext_len); 1798 } 1799 1800 if (ipsa->ipsa_replay != 0) { 1801 repl_ctr = (sadb_x_replay_ctr_t *)walker; 1802 repl_ctr->sadb_x_rc_len = SADB_8TO64(sizeof (*repl_ctr)); 1803 repl_ctr->sadb_x_rc_exttype = SADB_X_EXT_REPLAY_VALUE; 1804 repl_ctr->sadb_x_rc_replay32 = ipsa->ipsa_replay; 1805 repl_ctr->sadb_x_rc_replay64 = 0; 1806 walker = (sadb_ext_t *)(repl_ctr + 1); 1807 } 1808 1809 bail: 1810 /* Pardon any delays... */ 1811 mutex_exit(&ipsa->ipsa_lock); 1812 1813 return (mp); 1814 } 1815 1816 /* 1817 * Strip out key headers or unmarked headers (SADB_EXT_KEY_*, SADB_EXT_UNKNOWN) 1818 * and adjust base message accordingly. 1819 * 1820 * Assume message is pulled up in one piece of contiguous memory. 1821 * 1822 * Say if we start off with: 1823 * 1824 * +------+----+-------------+-----------+---------------+---------------+ 1825 * | base | SA | source addr | dest addr | rsrvd. or key | soft lifetime | 1826 * +------+----+-------------+-----------+---------------+---------------+ 1827 * 1828 * we will end up with 1829 * 1830 * +------+----+-------------+-----------+---------------+ 1831 * | base | SA | source addr | dest addr | soft lifetime | 1832 * +------+----+-------------+-----------+---------------+ 1833 */ 1834 static void 1835 sadb_strip(sadb_msg_t *samsg) 1836 { 1837 sadb_ext_t *ext; 1838 uint8_t *target = NULL; 1839 uint8_t *msgend; 1840 int sofar = SADB_8TO64(sizeof (*samsg)); 1841 int copylen; 1842 1843 ext = (sadb_ext_t *)(samsg + 1); 1844 msgend = (uint8_t *)samsg; 1845 msgend += SADB_64TO8(samsg->sadb_msg_len); 1846 while ((uint8_t *)ext < msgend) { 1847 if (ext->sadb_ext_type == SADB_EXT_RESERVED || 1848 ext->sadb_ext_type == SADB_EXT_KEY_AUTH || 1849 ext->sadb_ext_type == SADB_X_EXT_EDUMP || 1850 ext->sadb_ext_type == SADB_EXT_KEY_ENCRYPT) { 1851 /* 1852 * Aha! I found a header to be erased. 1853 */ 1854 1855 if (target != NULL) { 1856 /* 1857 * If I had a previous header to be erased, 1858 * copy over it. I can get away with just 1859 * copying backwards because the target will 1860 * always be 8 bytes behind the source. 1861 */ 1862 copylen = ((uint8_t *)ext) - (target + 1863 SADB_64TO8( 1864 ((sadb_ext_t *)target)->sadb_ext_len)); 1865 ovbcopy(((uint8_t *)ext - copylen), target, 1866 copylen); 1867 target += copylen; 1868 ((sadb_ext_t *)target)->sadb_ext_len = 1869 SADB_8TO64(((uint8_t *)ext) - target + 1870 SADB_64TO8(ext->sadb_ext_len)); 1871 } else { 1872 target = (uint8_t *)ext; 1873 } 1874 } else { 1875 sofar += ext->sadb_ext_len; 1876 } 1877 1878 ext = (sadb_ext_t *)(((uint64_t *)ext) + ext->sadb_ext_len); 1879 } 1880 1881 ASSERT((uint8_t *)ext == msgend); 1882 1883 if (target != NULL) { 1884 copylen = ((uint8_t *)ext) - (target + 1885 SADB_64TO8(((sadb_ext_t *)target)->sadb_ext_len)); 1886 if (copylen != 0) 1887 ovbcopy(((uint8_t *)ext - copylen), target, copylen); 1888 } 1889 1890 /* Adjust samsg. */ 1891 samsg->sadb_msg_len = (uint16_t)sofar; 1892 1893 /* Assume all of the rest is cleared by caller in sadb_pfkey_echo(). */ 1894 } 1895 1896 /* 1897 * AH needs to send an error to PF_KEY. Assume mp points to an M_CTL 1898 * followed by an M_DATA with a PF_KEY message in it. The serial of 1899 * the sending keysock instance is included. 1900 */ 1901 void 1902 sadb_pfkey_error(queue_t *pfkey_q, mblk_t *mp, int error, int diagnostic, 1903 uint_t serial) 1904 { 1905 mblk_t *msg = mp->b_cont; 1906 sadb_msg_t *samsg; 1907 keysock_out_t *kso; 1908 1909 /* 1910 * Enough functions call this to merit a NULL queue check. 1911 */ 1912 if (pfkey_q == NULL) { 1913 freemsg(mp); 1914 return; 1915 } 1916 1917 ASSERT(msg != NULL); 1918 ASSERT((mp->b_wptr - mp->b_rptr) == sizeof (ipsec_info_t)); 1919 ASSERT((msg->b_wptr - msg->b_rptr) >= sizeof (sadb_msg_t)); 1920 samsg = (sadb_msg_t *)msg->b_rptr; 1921 kso = (keysock_out_t *)mp->b_rptr; 1922 1923 kso->ks_out_type = KEYSOCK_OUT; 1924 kso->ks_out_len = sizeof (*kso); 1925 kso->ks_out_serial = serial; 1926 1927 /* 1928 * Only send the base message up in the event of an error. 1929 * Don't worry about bzero()-ing, because it was probably bogus 1930 * anyway. 1931 */ 1932 msg->b_wptr = msg->b_rptr + sizeof (*samsg); 1933 samsg = (sadb_msg_t *)msg->b_rptr; 1934 samsg->sadb_msg_len = SADB_8TO64(sizeof (*samsg)); 1935 samsg->sadb_msg_errno = (uint8_t)error; 1936 if (diagnostic != SADB_X_DIAGNOSTIC_PRESET) 1937 samsg->sadb_x_msg_diagnostic = (uint16_t)diagnostic; 1938 1939 putnext(pfkey_q, mp); 1940 } 1941 1942 /* 1943 * Send a successful return packet back to keysock via the queue in pfkey_q. 1944 * 1945 * Often, an SA is associated with the reply message, it's passed in if needed, 1946 * and NULL if not. BTW, that ipsa will have its refcnt appropriately held, 1947 * and the caller will release said refcnt. 1948 */ 1949 void 1950 sadb_pfkey_echo(queue_t *pfkey_q, mblk_t *mp, sadb_msg_t *samsg, 1951 keysock_in_t *ksi, ipsa_t *ipsa) 1952 { 1953 keysock_out_t *kso; 1954 mblk_t *mp1; 1955 sadb_msg_t *newsamsg; 1956 uint8_t *oldend; 1957 1958 ASSERT((mp->b_cont != NULL) && 1959 ((void *)samsg == (void *)mp->b_cont->b_rptr) && 1960 ((void *)mp->b_rptr == (void *)ksi)); 1961 1962 switch (samsg->sadb_msg_type) { 1963 case SADB_ADD: 1964 case SADB_UPDATE: 1965 case SADB_X_UPDATEPAIR: 1966 case SADB_X_DELPAIR_STATE: 1967 case SADB_FLUSH: 1968 case SADB_DUMP: 1969 /* 1970 * I have all of the message already. I just need to strip 1971 * out the keying material and echo the message back. 1972 * 1973 * NOTE: for SADB_DUMP, the function sadb_dump() did the 1974 * work. When DUMP reaches here, it should only be a base 1975 * message. 1976 */ 1977 justecho: 1978 if (ksi->ks_in_extv[SADB_EXT_KEY_AUTH] != NULL || 1979 ksi->ks_in_extv[SADB_EXT_KEY_ENCRYPT] != NULL || 1980 ksi->ks_in_extv[SADB_X_EXT_EDUMP] != NULL) { 1981 sadb_strip(samsg); 1982 /* Assume PF_KEY message is contiguous. */ 1983 ASSERT(mp->b_cont->b_cont == NULL); 1984 oldend = mp->b_cont->b_wptr; 1985 mp->b_cont->b_wptr = mp->b_cont->b_rptr + 1986 SADB_64TO8(samsg->sadb_msg_len); 1987 bzero(mp->b_cont->b_wptr, oldend - mp->b_cont->b_wptr); 1988 } 1989 break; 1990 case SADB_GET: 1991 /* 1992 * Do a lot of work here, because of the ipsa I just found. 1993 * First construct the new PF_KEY message, then abandon 1994 * the old one. 1995 */ 1996 mp1 = sadb_sa2msg(ipsa, samsg); 1997 if (mp1 == NULL) { 1998 sadb_pfkey_error(pfkey_q, mp, ENOMEM, 1999 SADB_X_DIAGNOSTIC_NONE, ksi->ks_in_serial); 2000 return; 2001 } 2002 freemsg(mp->b_cont); 2003 mp->b_cont = mp1; 2004 break; 2005 case SADB_DELETE: 2006 case SADB_X_DELPAIR: 2007 if (ipsa == NULL) 2008 goto justecho; 2009 /* 2010 * Because listening KMds may require more info, treat 2011 * DELETE like a special case of GET. 2012 */ 2013 mp1 = sadb_sa2msg(ipsa, samsg); 2014 if (mp1 == NULL) { 2015 sadb_pfkey_error(pfkey_q, mp, ENOMEM, 2016 SADB_X_DIAGNOSTIC_NONE, ksi->ks_in_serial); 2017 return; 2018 } 2019 newsamsg = (sadb_msg_t *)mp1->b_rptr; 2020 sadb_strip(newsamsg); 2021 oldend = mp1->b_wptr; 2022 mp1->b_wptr = mp1->b_rptr + SADB_64TO8(newsamsg->sadb_msg_len); 2023 bzero(mp1->b_wptr, oldend - mp1->b_wptr); 2024 freemsg(mp->b_cont); 2025 mp->b_cont = mp1; 2026 break; 2027 default: 2028 if (mp != NULL) 2029 freemsg(mp); 2030 return; 2031 } 2032 2033 /* ksi is now null and void. */ 2034 kso = (keysock_out_t *)ksi; 2035 kso->ks_out_type = KEYSOCK_OUT; 2036 kso->ks_out_len = sizeof (*kso); 2037 kso->ks_out_serial = ksi->ks_in_serial; 2038 /* We're ready to send... */ 2039 putnext(pfkey_q, mp); 2040 } 2041 2042 /* 2043 * Set up a global pfkey_q instance for AH, ESP, or some other consumer. 2044 */ 2045 void 2046 sadb_keysock_hello(queue_t **pfkey_qp, queue_t *q, mblk_t *mp, 2047 void (*ager)(void *), void *agerarg, timeout_id_t *top, int satype) 2048 { 2049 keysock_hello_ack_t *kha; 2050 queue_t *oldq; 2051 2052 ASSERT(OTHERQ(q) != NULL); 2053 2054 /* 2055 * First, check atomically that I'm the first and only keysock 2056 * instance. 2057 * 2058 * Use OTHERQ(q), because qreply(q, mp) == putnext(OTHERQ(q), mp), 2059 * and I want this module to say putnext(*_pfkey_q, mp) for PF_KEY 2060 * messages. 2061 */ 2062 2063 oldq = casptr((void **)pfkey_qp, NULL, OTHERQ(q)); 2064 if (oldq != NULL) { 2065 ASSERT(oldq != q); 2066 cmn_err(CE_WARN, "Danger! Multiple keysocks on top of %s.\n", 2067 (satype == SADB_SATYPE_ESP)? "ESP" : "AH or other"); 2068 freemsg(mp); 2069 return; 2070 } 2071 2072 kha = (keysock_hello_ack_t *)mp->b_rptr; 2073 kha->ks_hello_len = sizeof (keysock_hello_ack_t); 2074 kha->ks_hello_type = KEYSOCK_HELLO_ACK; 2075 kha->ks_hello_satype = (uint8_t)satype; 2076 2077 /* 2078 * If we made it past the casptr, then we have "exclusive" access 2079 * to the timeout handle. Fire it off after the default ager 2080 * interval. 2081 */ 2082 *top = qtimeout(*pfkey_qp, ager, agerarg, 2083 drv_usectohz(SADB_AGE_INTERVAL_DEFAULT * 1000)); 2084 2085 putnext(*pfkey_qp, mp); 2086 } 2087 2088 /* 2089 * Normalize IPv4-mapped IPv6 addresses (and prefixes) as appropriate. 2090 * 2091 * Check addresses themselves for wildcard or multicast. 2092 * Check ire table for local/non-local/broadcast. 2093 */ 2094 int 2095 sadb_addrcheck(queue_t *pfkey_q, mblk_t *mp, sadb_ext_t *ext, uint_t serial, 2096 netstack_t *ns) 2097 { 2098 sadb_address_t *addr = (sadb_address_t *)ext; 2099 struct sockaddr_in *sin; 2100 struct sockaddr_in6 *sin6; 2101 ire_t *ire; 2102 int diagnostic, type; 2103 boolean_t normalized = B_FALSE; 2104 2105 ASSERT(ext != NULL); 2106 ASSERT((ext->sadb_ext_type == SADB_EXT_ADDRESS_SRC) || 2107 (ext->sadb_ext_type == SADB_EXT_ADDRESS_DST) || 2108 (ext->sadb_ext_type == SADB_X_EXT_ADDRESS_INNER_SRC) || 2109 (ext->sadb_ext_type == SADB_X_EXT_ADDRESS_INNER_DST) || 2110 (ext->sadb_ext_type == SADB_X_EXT_ADDRESS_NATT_LOC) || 2111 (ext->sadb_ext_type == SADB_X_EXT_ADDRESS_NATT_REM)); 2112 2113 /* Assign both sockaddrs, the compiler will do the right thing. */ 2114 sin = (struct sockaddr_in *)(addr + 1); 2115 sin6 = (struct sockaddr_in6 *)(addr + 1); 2116 2117 if (sin6->sin6_family == AF_INET6) { 2118 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 2119 /* 2120 * Convert to an AF_INET sockaddr. This means the 2121 * return messages will have the extra space, but have 2122 * AF_INET sockaddrs instead of AF_INET6. 2123 * 2124 * Yes, RFC 2367 isn't clear on what to do here w.r.t. 2125 * mapped addresses, but since AF_INET6 ::ffff:<v4> is 2126 * equal to AF_INET <v4>, it shouldnt be a huge 2127 * problem. 2128 */ 2129 sin->sin_family = AF_INET; 2130 IN6_V4MAPPED_TO_INADDR(&sin6->sin6_addr, 2131 &sin->sin_addr); 2132 bzero(&sin->sin_zero, sizeof (sin->sin_zero)); 2133 normalized = B_TRUE; 2134 } 2135 } else if (sin->sin_family != AF_INET) { 2136 switch (ext->sadb_ext_type) { 2137 case SADB_EXT_ADDRESS_SRC: 2138 diagnostic = SADB_X_DIAGNOSTIC_BAD_SRC_AF; 2139 break; 2140 case SADB_EXT_ADDRESS_DST: 2141 diagnostic = SADB_X_DIAGNOSTIC_BAD_DST_AF; 2142 break; 2143 case SADB_X_EXT_ADDRESS_INNER_SRC: 2144 diagnostic = SADB_X_DIAGNOSTIC_BAD_PROXY_AF; 2145 break; 2146 case SADB_X_EXT_ADDRESS_INNER_DST: 2147 diagnostic = SADB_X_DIAGNOSTIC_BAD_INNER_DST_AF; 2148 break; 2149 case SADB_X_EXT_ADDRESS_NATT_LOC: 2150 diagnostic = SADB_X_DIAGNOSTIC_BAD_NATT_LOC_AF; 2151 break; 2152 case SADB_X_EXT_ADDRESS_NATT_REM: 2153 diagnostic = SADB_X_DIAGNOSTIC_BAD_NATT_REM_AF; 2154 break; 2155 /* There is no default, see above ASSERT. */ 2156 } 2157 bail: 2158 if (pfkey_q != NULL) { 2159 sadb_pfkey_error(pfkey_q, mp, EINVAL, diagnostic, 2160 serial); 2161 } else { 2162 /* 2163 * Scribble in sadb_msg that we got passed in. 2164 * Overload "mp" to be an sadb_msg pointer. 2165 */ 2166 sadb_msg_t *samsg = (sadb_msg_t *)mp; 2167 2168 samsg->sadb_msg_errno = EINVAL; 2169 samsg->sadb_x_msg_diagnostic = diagnostic; 2170 } 2171 return (KS_IN_ADDR_UNKNOWN); 2172 } 2173 2174 if (ext->sadb_ext_type == SADB_X_EXT_ADDRESS_INNER_SRC || 2175 ext->sadb_ext_type == SADB_X_EXT_ADDRESS_INNER_DST) { 2176 /* 2177 * We need only check for prefix issues. 2178 */ 2179 2180 /* Set diagnostic now, in case we need it later. */ 2181 diagnostic = 2182 (ext->sadb_ext_type == SADB_X_EXT_ADDRESS_INNER_SRC) ? 2183 SADB_X_DIAGNOSTIC_PREFIX_INNER_SRC : 2184 SADB_X_DIAGNOSTIC_PREFIX_INNER_DST; 2185 2186 if (normalized) 2187 addr->sadb_address_prefixlen -= 96; 2188 2189 /* 2190 * Verify and mask out inner-addresses based on prefix length. 2191 */ 2192 if (sin->sin_family == AF_INET) { 2193 if (addr->sadb_address_prefixlen > 32) 2194 goto bail; 2195 sin->sin_addr.s_addr &= 2196 ip_plen_to_mask(addr->sadb_address_prefixlen); 2197 } else { 2198 in6_addr_t mask; 2199 2200 ASSERT(sin->sin_family == AF_INET6); 2201 /* 2202 * ip_plen_to_mask_v6() returns NULL if the value in 2203 * question is out of range. 2204 */ 2205 if (ip_plen_to_mask_v6(addr->sadb_address_prefixlen, 2206 &mask) == NULL) 2207 goto bail; 2208 sin6->sin6_addr.s6_addr32[0] &= mask.s6_addr32[0]; 2209 sin6->sin6_addr.s6_addr32[1] &= mask.s6_addr32[1]; 2210 sin6->sin6_addr.s6_addr32[2] &= mask.s6_addr32[2]; 2211 sin6->sin6_addr.s6_addr32[3] &= mask.s6_addr32[3]; 2212 } 2213 2214 /* We don't care in these cases. */ 2215 return (KS_IN_ADDR_DONTCARE); 2216 } 2217 2218 if (sin->sin_family == AF_INET6) { 2219 /* Check the easy ones now. */ 2220 if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) 2221 return (KS_IN_ADDR_MBCAST); 2222 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) 2223 return (KS_IN_ADDR_UNSPEC); 2224 /* 2225 * At this point, we're a unicast IPv6 address. 2226 * 2227 * A ctable lookup for local is sufficient here. If we're 2228 * local, return KS_IN_ADDR_ME, otherwise KS_IN_ADDR_NOTME. 2229 * 2230 * XXX Zones alert -> me/notme decision needs to be tempered 2231 * by what zone we're in when we go to zone-aware IPsec. 2232 */ 2233 ire = ire_ctable_lookup_v6(&sin6->sin6_addr, NULL, 2234 IRE_LOCAL, NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, 2235 ns->netstack_ip); 2236 if (ire != NULL) { 2237 /* Hey hey, it's local. */ 2238 IRE_REFRELE(ire); 2239 return (KS_IN_ADDR_ME); 2240 } 2241 } else { 2242 ASSERT(sin->sin_family == AF_INET); 2243 if (sin->sin_addr.s_addr == INADDR_ANY) 2244 return (KS_IN_ADDR_UNSPEC); 2245 if (CLASSD(sin->sin_addr.s_addr)) 2246 return (KS_IN_ADDR_MBCAST); 2247 /* 2248 * At this point we're a unicast or broadcast IPv4 address. 2249 * 2250 * Lookup on the ctable for IRE_BROADCAST or IRE_LOCAL. 2251 * A NULL return value is NOTME, otherwise, look at the 2252 * returned ire for broadcast or not and return accordingly. 2253 * 2254 * XXX Zones alert -> me/notme decision needs to be tempered 2255 * by what zone we're in when we go to zone-aware IPsec. 2256 */ 2257 ire = ire_ctable_lookup(sin->sin_addr.s_addr, 0, 2258 IRE_LOCAL | IRE_BROADCAST, NULL, ALL_ZONES, NULL, 2259 MATCH_IRE_TYPE, ns->netstack_ip); 2260 if (ire != NULL) { 2261 /* Check for local or broadcast */ 2262 type = ire->ire_type; 2263 IRE_REFRELE(ire); 2264 ASSERT(type == IRE_LOCAL || type == IRE_BROADCAST); 2265 return ((type == IRE_LOCAL) ? KS_IN_ADDR_ME : 2266 KS_IN_ADDR_MBCAST); 2267 } 2268 } 2269 2270 return (KS_IN_ADDR_NOTME); 2271 } 2272 2273 /* 2274 * Address normalizations and reality checks for inbound PF_KEY messages. 2275 * 2276 * For the case of src == unspecified AF_INET6, and dst == AF_INET, convert 2277 * the source to AF_INET. Do the same for the inner sources. 2278 */ 2279 boolean_t 2280 sadb_addrfix(keysock_in_t *ksi, queue_t *pfkey_q, mblk_t *mp, netstack_t *ns) 2281 { 2282 struct sockaddr_in *src, *isrc; 2283 struct sockaddr_in6 *dst, *idst; 2284 sadb_address_t *srcext, *dstext; 2285 uint16_t sport; 2286 sadb_ext_t **extv = ksi->ks_in_extv; 2287 int rc; 2288 2289 if (extv[SADB_EXT_ADDRESS_SRC] != NULL) { 2290 rc = sadb_addrcheck(pfkey_q, mp, extv[SADB_EXT_ADDRESS_SRC], 2291 ksi->ks_in_serial, ns); 2292 if (rc == KS_IN_ADDR_UNKNOWN) 2293 return (B_FALSE); 2294 if (rc == KS_IN_ADDR_MBCAST) { 2295 sadb_pfkey_error(pfkey_q, mp, EINVAL, 2296 SADB_X_DIAGNOSTIC_BAD_SRC, ksi->ks_in_serial); 2297 return (B_FALSE); 2298 } 2299 ksi->ks_in_srctype = rc; 2300 } 2301 2302 if (extv[SADB_EXT_ADDRESS_DST] != NULL) { 2303 rc = sadb_addrcheck(pfkey_q, mp, extv[SADB_EXT_ADDRESS_DST], 2304 ksi->ks_in_serial, ns); 2305 if (rc == KS_IN_ADDR_UNKNOWN) 2306 return (B_FALSE); 2307 if (rc == KS_IN_ADDR_UNSPEC) { 2308 sadb_pfkey_error(pfkey_q, mp, EINVAL, 2309 SADB_X_DIAGNOSTIC_BAD_DST, ksi->ks_in_serial); 2310 return (B_FALSE); 2311 } 2312 ksi->ks_in_dsttype = rc; 2313 } 2314 2315 /* 2316 * NAT-Traversal addrs are simple enough to not require all of 2317 * the checks in sadb_addrcheck(). Just normalize or reject if not 2318 * AF_INET. 2319 */ 2320 if (extv[SADB_X_EXT_ADDRESS_NATT_LOC] != NULL) { 2321 rc = sadb_addrcheck(pfkey_q, mp, 2322 extv[SADB_X_EXT_ADDRESS_NATT_LOC], ksi->ks_in_serial, ns); 2323 2324 /* 2325 * Local NAT-T addresses never use an IRE_LOCAL, so it should 2326 * always be NOTME, or UNSPEC (to handle both tunnel mode 2327 * AND local-port flexibility). 2328 */ 2329 if (rc != KS_IN_ADDR_NOTME && rc != KS_IN_ADDR_UNSPEC) { 2330 sadb_pfkey_error(pfkey_q, mp, EINVAL, 2331 SADB_X_DIAGNOSTIC_MALFORMED_NATT_LOC, 2332 ksi->ks_in_serial); 2333 return (B_FALSE); 2334 } 2335 src = (struct sockaddr_in *) 2336 (((sadb_address_t *)extv[SADB_X_EXT_ADDRESS_NATT_LOC]) + 1); 2337 if (src->sin_family != AF_INET) { 2338 sadb_pfkey_error(pfkey_q, mp, EINVAL, 2339 SADB_X_DIAGNOSTIC_BAD_NATT_LOC_AF, 2340 ksi->ks_in_serial); 2341 return (B_FALSE); 2342 } 2343 } 2344 2345 if (extv[SADB_X_EXT_ADDRESS_NATT_REM] != NULL) { 2346 rc = sadb_addrcheck(pfkey_q, mp, 2347 extv[SADB_X_EXT_ADDRESS_NATT_REM], ksi->ks_in_serial, ns); 2348 2349 /* 2350 * Remote NAT-T addresses never use an IRE_LOCAL, so it should 2351 * always be NOTME, or UNSPEC if it's a tunnel-mode SA. 2352 */ 2353 if (rc != KS_IN_ADDR_NOTME && 2354 !(extv[SADB_X_EXT_ADDRESS_INNER_SRC] != NULL && 2355 rc == KS_IN_ADDR_UNSPEC)) { 2356 sadb_pfkey_error(pfkey_q, mp, EINVAL, 2357 SADB_X_DIAGNOSTIC_MALFORMED_NATT_REM, 2358 ksi->ks_in_serial); 2359 return (B_FALSE); 2360 } 2361 src = (struct sockaddr_in *) 2362 (((sadb_address_t *)extv[SADB_X_EXT_ADDRESS_NATT_REM]) + 1); 2363 if (src->sin_family != AF_INET) { 2364 sadb_pfkey_error(pfkey_q, mp, EINVAL, 2365 SADB_X_DIAGNOSTIC_BAD_NATT_REM_AF, 2366 ksi->ks_in_serial); 2367 return (B_FALSE); 2368 } 2369 } 2370 2371 if (extv[SADB_X_EXT_ADDRESS_INNER_SRC] != NULL) { 2372 if (extv[SADB_X_EXT_ADDRESS_INNER_DST] == NULL) { 2373 sadb_pfkey_error(pfkey_q, mp, EINVAL, 2374 SADB_X_DIAGNOSTIC_MISSING_INNER_DST, 2375 ksi->ks_in_serial); 2376 return (B_FALSE); 2377 } 2378 2379 if (sadb_addrcheck(pfkey_q, mp, 2380 extv[SADB_X_EXT_ADDRESS_INNER_DST], ksi->ks_in_serial, ns) 2381 == KS_IN_ADDR_UNKNOWN || 2382 sadb_addrcheck(pfkey_q, mp, 2383 extv[SADB_X_EXT_ADDRESS_INNER_SRC], ksi->ks_in_serial, ns) 2384 == KS_IN_ADDR_UNKNOWN) 2385 return (B_FALSE); 2386 2387 isrc = (struct sockaddr_in *) 2388 (((sadb_address_t *)extv[SADB_X_EXT_ADDRESS_INNER_SRC]) + 2389 1); 2390 idst = (struct sockaddr_in6 *) 2391 (((sadb_address_t *)extv[SADB_X_EXT_ADDRESS_INNER_DST]) + 2392 1); 2393 if (isrc->sin_family != idst->sin6_family) { 2394 sadb_pfkey_error(pfkey_q, mp, EINVAL, 2395 SADB_X_DIAGNOSTIC_INNER_AF_MISMATCH, 2396 ksi->ks_in_serial); 2397 return (B_FALSE); 2398 } 2399 } else if (extv[SADB_X_EXT_ADDRESS_INNER_DST] != NULL) { 2400 sadb_pfkey_error(pfkey_q, mp, EINVAL, 2401 SADB_X_DIAGNOSTIC_MISSING_INNER_SRC, 2402 ksi->ks_in_serial); 2403 return (B_FALSE); 2404 } else { 2405 isrc = NULL; /* For inner/outer port check below. */ 2406 } 2407 2408 dstext = (sadb_address_t *)extv[SADB_EXT_ADDRESS_DST]; 2409 srcext = (sadb_address_t *)extv[SADB_EXT_ADDRESS_SRC]; 2410 2411 if (dstext == NULL || srcext == NULL) 2412 return (B_TRUE); 2413 2414 dst = (struct sockaddr_in6 *)(dstext + 1); 2415 src = (struct sockaddr_in *)(srcext + 1); 2416 2417 if (isrc != NULL && 2418 (isrc->sin_port != 0 || idst->sin6_port != 0) && 2419 (src->sin_port != 0 || dst->sin6_port != 0)) { 2420 /* Can't set inner and outer ports in one SA. */ 2421 sadb_pfkey_error(pfkey_q, mp, EINVAL, 2422 SADB_X_DIAGNOSTIC_DUAL_PORT_SETS, 2423 ksi->ks_in_serial); 2424 return (B_FALSE); 2425 } 2426 2427 if (dst->sin6_family == src->sin_family) 2428 return (B_TRUE); 2429 2430 if (srcext->sadb_address_proto != dstext->sadb_address_proto) { 2431 if (srcext->sadb_address_proto == 0) { 2432 srcext->sadb_address_proto = dstext->sadb_address_proto; 2433 } else if (dstext->sadb_address_proto == 0) { 2434 dstext->sadb_address_proto = srcext->sadb_address_proto; 2435 } else { 2436 /* Inequal protocols, neither were 0. Report error. */ 2437 sadb_pfkey_error(pfkey_q, mp, EINVAL, 2438 SADB_X_DIAGNOSTIC_PROTO_MISMATCH, 2439 ksi->ks_in_serial); 2440 return (B_FALSE); 2441 } 2442 } 2443 2444 /* 2445 * With the exception of an unspec IPv6 source and an IPv4 2446 * destination, address families MUST me matched. 2447 */ 2448 if (src->sin_family == AF_INET || 2449 ksi->ks_in_srctype != KS_IN_ADDR_UNSPEC) { 2450 sadb_pfkey_error(pfkey_q, mp, EINVAL, 2451 SADB_X_DIAGNOSTIC_AF_MISMATCH, ksi->ks_in_serial); 2452 return (B_FALSE); 2453 } 2454 2455 /* 2456 * Convert "src" to AF_INET INADDR_ANY. We rely on sin_port being 2457 * in the same place for sockaddr_in and sockaddr_in6. 2458 */ 2459 sport = src->sin_port; 2460 bzero(src, sizeof (*src)); 2461 src->sin_family = AF_INET; 2462 src->sin_port = sport; 2463 2464 return (B_TRUE); 2465 } 2466 2467 /* 2468 * Set the results in "addrtype", given an IRE as requested by 2469 * sadb_addrcheck(). 2470 */ 2471 int 2472 sadb_addrset(ire_t *ire) 2473 { 2474 if ((ire->ire_type & IRE_BROADCAST) || 2475 (ire->ire_ipversion == IPV4_VERSION && CLASSD(ire->ire_addr)) || 2476 (ire->ire_ipversion == IPV6_VERSION && 2477 IN6_IS_ADDR_MULTICAST(&(ire->ire_addr_v6)))) 2478 return (KS_IN_ADDR_MBCAST); 2479 if (ire->ire_type & (IRE_LOCAL | IRE_LOOPBACK)) 2480 return (KS_IN_ADDR_ME); 2481 return (KS_IN_ADDR_NOTME); 2482 } 2483 2484 2485 /* 2486 * Walker callback function to delete sa's based on src/dst address. 2487 * Assumes that we're called with *head locked, no other locks held; 2488 * Conveniently, and not coincidentally, this is both what sadb_walker 2489 * gives us and also what sadb_unlinkassoc expects. 2490 */ 2491 2492 struct sadb_purge_state 2493 { 2494 uint32_t *src; 2495 uint32_t *dst; 2496 sa_family_t af; 2497 boolean_t inbnd; 2498 char *sidstr; 2499 char *didstr; 2500 uint16_t sidtype; 2501 uint16_t didtype; 2502 uint32_t kmproto; 2503 uint8_t sadb_sa_state; 2504 mblk_t *mq; 2505 sadb_t *sp; 2506 }; 2507 2508 static void 2509 sadb_purge_cb(isaf_t *head, ipsa_t *entry, void *cookie) 2510 { 2511 struct sadb_purge_state *ps = (struct sadb_purge_state *)cookie; 2512 2513 ASSERT(MUTEX_HELD(&head->isaf_lock)); 2514 2515 mutex_enter(&entry->ipsa_lock); 2516 2517 if ((entry->ipsa_state == IPSA_STATE_LARVAL) || 2518 (ps->src != NULL && 2519 !IPSA_ARE_ADDR_EQUAL(entry->ipsa_srcaddr, ps->src, ps->af)) || 2520 (ps->dst != NULL && 2521 !IPSA_ARE_ADDR_EQUAL(entry->ipsa_dstaddr, ps->dst, ps->af)) || 2522 (ps->didstr != NULL && (entry->ipsa_dst_cid != NULL) && 2523 !(ps->didtype == entry->ipsa_dst_cid->ipsid_type && 2524 strcmp(ps->didstr, entry->ipsa_dst_cid->ipsid_cid) == 0)) || 2525 (ps->sidstr != NULL && (entry->ipsa_src_cid != NULL) && 2526 !(ps->sidtype == entry->ipsa_src_cid->ipsid_type && 2527 strcmp(ps->sidstr, entry->ipsa_src_cid->ipsid_cid) == 0)) || 2528 (ps->kmproto <= SADB_X_KMP_MAX && ps->kmproto != entry->ipsa_kmp)) { 2529 mutex_exit(&entry->ipsa_lock); 2530 return; 2531 } 2532 2533 if (ps->inbnd) { 2534 sadb_delete_cluster(entry); 2535 } 2536 entry->ipsa_state = IPSA_STATE_DEAD; 2537 (void) sadb_torch_assoc(head, entry, ps->inbnd, &ps->mq); 2538 } 2539 2540 /* 2541 * Common code to purge an SA with a matching src or dst address. 2542 * Don't kill larval SA's in such a purge. 2543 */ 2544 int 2545 sadb_purge_sa(mblk_t *mp, keysock_in_t *ksi, sadb_t *sp, queue_t *pfkey_q, 2546 queue_t *ip_q) 2547 { 2548 sadb_address_t *dstext = 2549 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_DST]; 2550 sadb_address_t *srcext = 2551 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_SRC]; 2552 sadb_ident_t *dstid = 2553 (sadb_ident_t *)ksi->ks_in_extv[SADB_EXT_IDENTITY_DST]; 2554 sadb_ident_t *srcid = 2555 (sadb_ident_t *)ksi->ks_in_extv[SADB_EXT_IDENTITY_SRC]; 2556 sadb_x_kmc_t *kmc = 2557 (sadb_x_kmc_t *)ksi->ks_in_extv[SADB_X_EXT_KM_COOKIE]; 2558 struct sockaddr_in *src, *dst; 2559 struct sockaddr_in6 *src6, *dst6; 2560 struct sadb_purge_state ps; 2561 2562 /* 2563 * Don't worry about IPv6 v4-mapped addresses, sadb_addrcheck() 2564 * takes care of them. 2565 */ 2566 2567 /* enforced by caller */ 2568 ASSERT((dstext != NULL) || (srcext != NULL)); 2569 2570 ps.src = NULL; 2571 ps.dst = NULL; 2572 #ifdef DEBUG 2573 ps.af = (sa_family_t)-1; 2574 #endif 2575 ps.mq = NULL; 2576 ps.sidstr = NULL; 2577 ps.didstr = NULL; 2578 ps.kmproto = SADB_X_KMP_MAX + 1; 2579 2580 if (dstext != NULL) { 2581 dst = (struct sockaddr_in *)(dstext + 1); 2582 ps.af = dst->sin_family; 2583 if (dst->sin_family == AF_INET6) { 2584 dst6 = (struct sockaddr_in6 *)dst; 2585 ps.dst = (uint32_t *)&dst6->sin6_addr; 2586 } else { 2587 ps.dst = (uint32_t *)&dst->sin_addr; 2588 } 2589 } 2590 2591 if (srcext != NULL) { 2592 src = (struct sockaddr_in *)(srcext + 1); 2593 ps.af = src->sin_family; 2594 if (src->sin_family == AF_INET6) { 2595 src6 = (struct sockaddr_in6 *)(srcext + 1); 2596 ps.src = (uint32_t *)&src6->sin6_addr; 2597 } else { 2598 ps.src = (uint32_t *)&src->sin_addr; 2599 } 2600 ASSERT(dstext == NULL || src->sin_family == dst->sin_family); 2601 } 2602 2603 ASSERT(ps.af != (sa_family_t)-1); 2604 2605 if (dstid != NULL) { 2606 /* 2607 * NOTE: May need to copy string in the future 2608 * if the inbound keysock message disappears for some strange 2609 * reason. 2610 */ 2611 ps.didstr = (char *)(dstid + 1); 2612 ps.didtype = dstid->sadb_ident_type; 2613 } 2614 2615 if (srcid != NULL) { 2616 /* 2617 * NOTE: May need to copy string in the future 2618 * if the inbound keysock message disappears for some strange 2619 * reason. 2620 */ 2621 ps.sidstr = (char *)(srcid + 1); 2622 ps.sidtype = srcid->sadb_ident_type; 2623 } 2624 2625 if (kmc != NULL) 2626 ps.kmproto = kmc->sadb_x_kmc_proto; 2627 2628 /* 2629 * This is simple, crude, and effective. 2630 * Unimplemented optimizations (TBD): 2631 * - we can limit how many places we search based on where we 2632 * think the SA is filed. 2633 * - if we get a dst address, we can hash based on dst addr to find 2634 * the correct bucket in the outbound table. 2635 */ 2636 ps.inbnd = B_TRUE; 2637 sadb_walker(sp->sdb_if, sp->sdb_hashsize, sadb_purge_cb, &ps); 2638 ps.inbnd = B_FALSE; 2639 sadb_walker(sp->sdb_of, sp->sdb_hashsize, sadb_purge_cb, &ps); 2640 2641 if (ps.mq != NULL) 2642 sadb_drain_torchq(ip_q, ps.mq); 2643 2644 ASSERT(mp->b_cont != NULL); 2645 sadb_pfkey_echo(pfkey_q, mp, (sadb_msg_t *)mp->b_cont->b_rptr, ksi, 2646 NULL); 2647 return (0); 2648 } 2649 2650 static void 2651 sadb_delpair_state(isaf_t *head, ipsa_t *entry, void *cookie) 2652 { 2653 struct sadb_purge_state *ps = (struct sadb_purge_state *)cookie; 2654 isaf_t *inbound_bucket; 2655 ipsa_t *peer_assoc; 2656 2657 ASSERT(MUTEX_HELD(&head->isaf_lock)); 2658 2659 mutex_enter(&entry->ipsa_lock); 2660 2661 if ((entry->ipsa_state != ps->sadb_sa_state) || 2662 ((ps->src != NULL) && 2663 !IPSA_ARE_ADDR_EQUAL(entry->ipsa_srcaddr, ps->src, ps->af))) { 2664 mutex_exit(&entry->ipsa_lock); 2665 return; 2666 } 2667 2668 /* 2669 * The isaf_t *, which is passed in , is always an outbound bucket, 2670 * and we are preserving the outbound-then-inbound hash-bucket lock 2671 * ordering. The sadb_walker() which triggers this function is called 2672 * only on the outbound fanout, and the corresponding inbound bucket 2673 * lock is safe to acquire here. 2674 */ 2675 2676 if (entry->ipsa_haspeer) { 2677 inbound_bucket = INBOUND_BUCKET(ps->sp, entry->ipsa_spi); 2678 mutex_enter(&inbound_bucket->isaf_lock); 2679 peer_assoc = ipsec_getassocbyspi(inbound_bucket, 2680 entry->ipsa_spi, entry->ipsa_srcaddr, 2681 entry->ipsa_dstaddr, entry->ipsa_addrfam); 2682 } else { 2683 inbound_bucket = INBOUND_BUCKET(ps->sp, entry->ipsa_otherspi); 2684 mutex_enter(&inbound_bucket->isaf_lock); 2685 peer_assoc = ipsec_getassocbyspi(inbound_bucket, 2686 entry->ipsa_otherspi, entry->ipsa_dstaddr, 2687 entry->ipsa_srcaddr, entry->ipsa_addrfam); 2688 } 2689 2690 entry->ipsa_state = IPSA_STATE_DEAD; 2691 (void) sadb_torch_assoc(head, entry, B_FALSE, &ps->mq); 2692 if (peer_assoc != NULL) { 2693 mutex_enter(&peer_assoc->ipsa_lock); 2694 peer_assoc->ipsa_state = IPSA_STATE_DEAD; 2695 (void) sadb_torch_assoc(inbound_bucket, peer_assoc, 2696 B_FALSE, &ps->mq); 2697 } 2698 mutex_exit(&inbound_bucket->isaf_lock); 2699 } 2700 2701 /* 2702 * Common code to delete/get an SA. 2703 */ 2704 int 2705 sadb_delget_sa(mblk_t *mp, keysock_in_t *ksi, sadbp_t *spp, 2706 int *diagnostic, queue_t *pfkey_q, uint8_t sadb_msg_type) 2707 { 2708 sadb_sa_t *assoc = (sadb_sa_t *)ksi->ks_in_extv[SADB_EXT_SA]; 2709 sadb_address_t *srcext = 2710 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_SRC]; 2711 sadb_address_t *dstext = 2712 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_DST]; 2713 ipsa_t *echo_target = NULL; 2714 ipsap_t *ipsapp; 2715 mblk_t *torchq = NULL; 2716 uint_t error = 0; 2717 2718 if (assoc == NULL) { 2719 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_SA; 2720 return (EINVAL); 2721 } 2722 2723 if (sadb_msg_type == SADB_X_DELPAIR_STATE) { 2724 struct sockaddr_in *src; 2725 struct sockaddr_in6 *src6; 2726 struct sadb_purge_state ps; 2727 2728 if (srcext == NULL) { 2729 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_SRC; 2730 return (EINVAL); 2731 } 2732 ps.src = NULL; 2733 ps.mq = NULL; 2734 src = (struct sockaddr_in *)(srcext + 1); 2735 ps.af = src->sin_family; 2736 if (src->sin_family == AF_INET6) { 2737 src6 = (struct sockaddr_in6 *)(srcext + 1); 2738 ps.src = (uint32_t *)&src6->sin6_addr; 2739 ps.sp = &spp->s_v6; 2740 } else { 2741 ps.src = (uint32_t *)&src->sin_addr; 2742 ps.sp = &spp->s_v4; 2743 } 2744 ps.inbnd = B_FALSE; 2745 ps.sadb_sa_state = assoc->sadb_sa_state; 2746 sadb_walker(ps.sp->sdb_of, ps.sp->sdb_hashsize, 2747 sadb_delpair_state, &ps); 2748 2749 if (ps.mq != NULL) 2750 sadb_drain_torchq(pfkey_q, ps.mq); 2751 2752 ASSERT(mp->b_cont != NULL); 2753 sadb_pfkey_echo(pfkey_q, mp, (sadb_msg_t *)mp->b_cont->b_rptr, 2754 ksi, NULL); 2755 return (0); 2756 } 2757 2758 if (dstext == NULL) { 2759 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_DST; 2760 return (EINVAL); 2761 } 2762 2763 ipsapp = get_ipsa_pair(assoc, srcext, dstext, spp); 2764 if (ipsapp == NULL) { 2765 *diagnostic = SADB_X_DIAGNOSTIC_SA_NOTFOUND; 2766 return (ESRCH); 2767 } 2768 2769 echo_target = ipsapp->ipsap_sa_ptr; 2770 if (echo_target == NULL) 2771 echo_target = ipsapp->ipsap_psa_ptr; 2772 2773 if (sadb_msg_type == SADB_DELETE || sadb_msg_type == SADB_X_DELPAIR) { 2774 /* 2775 * Bucket locks will be required if SA is actually unlinked. 2776 * get_ipsa_pair() returns valid hash bucket pointers even 2777 * if it can't find a pair SA pointer. 2778 */ 2779 mutex_enter(&ipsapp->ipsap_bucket->isaf_lock); 2780 mutex_enter(&ipsapp->ipsap_pbucket->isaf_lock); 2781 2782 if (ipsapp->ipsap_sa_ptr != NULL) { 2783 mutex_enter(&ipsapp->ipsap_sa_ptr->ipsa_lock); 2784 if (ipsapp->ipsap_sa_ptr->ipsa_flags & IPSA_F_INBOUND) { 2785 sadb_delete_cluster(ipsapp->ipsap_sa_ptr); 2786 } 2787 ipsapp->ipsap_sa_ptr->ipsa_state = IPSA_STATE_DEAD; 2788 (void) sadb_torch_assoc(ipsapp->ipsap_bucket, 2789 ipsapp->ipsap_sa_ptr, B_FALSE, &torchq); 2790 /* 2791 * sadb_torch_assoc() releases the ipsa_lock 2792 * and calls sadb_unlinkassoc() which does a 2793 * IPSA_REFRELE. 2794 */ 2795 } 2796 if (ipsapp->ipsap_psa_ptr != NULL) { 2797 mutex_enter(&ipsapp->ipsap_psa_ptr->ipsa_lock); 2798 if (sadb_msg_type == SADB_X_DELPAIR || 2799 ipsapp->ipsap_psa_ptr->ipsa_haspeer) { 2800 if (ipsapp->ipsap_psa_ptr->ipsa_flags & 2801 IPSA_F_INBOUND) { 2802 sadb_delete_cluster( 2803 ipsapp->ipsap_psa_ptr); 2804 } 2805 ipsapp->ipsap_psa_ptr->ipsa_state = 2806 IPSA_STATE_DEAD; 2807 (void) sadb_torch_assoc(ipsapp->ipsap_pbucket, 2808 ipsapp->ipsap_psa_ptr, B_FALSE, &torchq); 2809 } else { 2810 /* 2811 * Only half of the "pair" has been deleted. 2812 * Update the remaining SA and remove references 2813 * to its pair SA, which is now gone. 2814 */ 2815 ipsapp->ipsap_psa_ptr->ipsa_otherspi = 0; 2816 ipsapp->ipsap_psa_ptr->ipsa_flags &= 2817 ~IPSA_F_PAIRED; 2818 mutex_exit(&ipsapp->ipsap_psa_ptr->ipsa_lock); 2819 } 2820 } else if (sadb_msg_type == SADB_X_DELPAIR) { 2821 *diagnostic = SADB_X_DIAGNOSTIC_PAIR_SA_NOTFOUND; 2822 error = ESRCH; 2823 } 2824 mutex_exit(&ipsapp->ipsap_bucket->isaf_lock); 2825 mutex_exit(&ipsapp->ipsap_pbucket->isaf_lock); 2826 } 2827 2828 if (torchq != NULL) 2829 sadb_drain_torchq(spp->s_ip_q, torchq); 2830 2831 ASSERT(mp->b_cont != NULL); 2832 2833 if (error == 0) 2834 sadb_pfkey_echo(pfkey_q, mp, (sadb_msg_t *) 2835 mp->b_cont->b_rptr, ksi, echo_target); 2836 2837 destroy_ipsa_pair(ipsapp); 2838 2839 return (error); 2840 } 2841 2842 /* 2843 * This function takes a sadb_sa_t and finds the ipsa_t structure 2844 * and the isaf_t (hash bucket) that its stored under. If the security 2845 * association has a peer, the ipsa_t structure and bucket for that security 2846 * association are also searched for. The "pair" of ipsa_t's and isaf_t's 2847 * are returned as a ipsap_t. 2848 * 2849 * Note that a "pair" is defined as one (but not both) of the following: 2850 * 2851 * A security association which has a soft reference to another security 2852 * association via its SPI. 2853 * 2854 * A security association that is not obviously "inbound" or "outbound" so 2855 * it appears in both hash tables, the "peer" being the same security 2856 * association in the other hash table. 2857 * 2858 * This function will return NULL if the ipsa_t can't be found in the 2859 * inbound or outbound hash tables (not found). If only one ipsa_t is 2860 * found, the pair ipsa_t will be NULL. Both isaf_t values are valid 2861 * provided at least one ipsa_t is found. 2862 */ 2863 ipsap_t * 2864 get_ipsa_pair(sadb_sa_t *assoc, sadb_address_t *srcext, sadb_address_t *dstext, 2865 sadbp_t *spp) 2866 { 2867 struct sockaddr_in *src, *dst; 2868 struct sockaddr_in6 *src6, *dst6; 2869 sadb_t *sp; 2870 uint32_t *srcaddr, *dstaddr; 2871 isaf_t *outbound_bucket, *inbound_bucket; 2872 boolean_t in_inbound_table = B_FALSE; 2873 ipsap_t *ipsapp; 2874 sa_family_t af; 2875 2876 uint32_t pair_srcaddr[IPSA_MAX_ADDRLEN]; 2877 uint32_t pair_dstaddr[IPSA_MAX_ADDRLEN]; 2878 uint32_t pair_spi; 2879 2880 ipsapp = kmem_zalloc(sizeof (*ipsapp), KM_NOSLEEP); 2881 if (ipsapp == NULL) 2882 return (NULL); 2883 2884 /* 2885 * Don't worry about IPv6 v4-mapped addresses, sadb_addrcheck() 2886 * takes care of them. 2887 */ 2888 2889 dst = (struct sockaddr_in *)(dstext + 1); 2890 af = dst->sin_family; 2891 if (af == AF_INET6) { 2892 sp = &spp->s_v6; 2893 dst6 = (struct sockaddr_in6 *)dst; 2894 dstaddr = (uint32_t *)&dst6->sin6_addr; 2895 if (srcext != NULL) { 2896 src6 = (struct sockaddr_in6 *)(srcext + 1); 2897 srcaddr = (uint32_t *)&src6->sin6_addr; 2898 ASSERT(src6->sin6_family == af); 2899 ASSERT(src6->sin6_family == AF_INET6); 2900 } else { 2901 srcaddr = ALL_ZEROES_PTR; 2902 } 2903 outbound_bucket = OUTBOUND_BUCKET_V6(sp, 2904 *(uint32_t *)dstaddr); 2905 } else { 2906 sp = &spp->s_v4; 2907 dstaddr = (uint32_t *)&dst->sin_addr; 2908 if (srcext != NULL) { 2909 src = (struct sockaddr_in *)(srcext + 1); 2910 srcaddr = (uint32_t *)&src->sin_addr; 2911 ASSERT(src->sin_family == af); 2912 ASSERT(src->sin_family == AF_INET); 2913 } else { 2914 srcaddr = ALL_ZEROES_PTR; 2915 } 2916 outbound_bucket = OUTBOUND_BUCKET_V4(sp, 2917 *(uint32_t *)dstaddr); 2918 } 2919 2920 inbound_bucket = INBOUND_BUCKET(sp, assoc->sadb_sa_spi); 2921 2922 /* Lock down both buckets. */ 2923 mutex_enter(&outbound_bucket->isaf_lock); 2924 mutex_enter(&inbound_bucket->isaf_lock); 2925 2926 if (assoc->sadb_sa_flags & IPSA_F_INBOUND) { 2927 ipsapp->ipsap_sa_ptr = ipsec_getassocbyspi(inbound_bucket, 2928 assoc->sadb_sa_spi, srcaddr, dstaddr, af); 2929 if (ipsapp->ipsap_sa_ptr != NULL) { 2930 ipsapp->ipsap_bucket = inbound_bucket; 2931 ipsapp->ipsap_pbucket = outbound_bucket; 2932 in_inbound_table = B_TRUE; 2933 } else { 2934 ipsapp->ipsap_sa_ptr = 2935 ipsec_getassocbyspi(outbound_bucket, 2936 assoc->sadb_sa_spi, srcaddr, dstaddr, af); 2937 ipsapp->ipsap_bucket = outbound_bucket; 2938 ipsapp->ipsap_pbucket = inbound_bucket; 2939 } 2940 } else { 2941 /* IPSA_F_OUTBOUND is set *or* no directions flags set. */ 2942 ipsapp->ipsap_sa_ptr = 2943 ipsec_getassocbyspi(outbound_bucket, 2944 assoc->sadb_sa_spi, srcaddr, dstaddr, af); 2945 if (ipsapp->ipsap_sa_ptr != NULL) { 2946 ipsapp->ipsap_bucket = outbound_bucket; 2947 ipsapp->ipsap_pbucket = inbound_bucket; 2948 } else { 2949 ipsapp->ipsap_sa_ptr = 2950 ipsec_getassocbyspi(inbound_bucket, 2951 assoc->sadb_sa_spi, srcaddr, dstaddr, af); 2952 ipsapp->ipsap_bucket = inbound_bucket; 2953 ipsapp->ipsap_pbucket = outbound_bucket; 2954 if (ipsapp->ipsap_sa_ptr != NULL) 2955 in_inbound_table = B_TRUE; 2956 } 2957 } 2958 2959 if (ipsapp->ipsap_sa_ptr == NULL) { 2960 mutex_exit(&outbound_bucket->isaf_lock); 2961 mutex_exit(&inbound_bucket->isaf_lock); 2962 kmem_free(ipsapp, sizeof (*ipsapp)); 2963 return (NULL); 2964 } 2965 2966 if ((ipsapp->ipsap_sa_ptr->ipsa_state == IPSA_STATE_LARVAL) && 2967 in_inbound_table) { 2968 mutex_exit(&outbound_bucket->isaf_lock); 2969 mutex_exit(&inbound_bucket->isaf_lock); 2970 return (ipsapp); 2971 } 2972 2973 mutex_enter(&ipsapp->ipsap_sa_ptr->ipsa_lock); 2974 if (ipsapp->ipsap_sa_ptr->ipsa_haspeer) { 2975 /* 2976 * haspeer implies no sa_pairing, look for same spi 2977 * in other hashtable. 2978 */ 2979 ipsapp->ipsap_psa_ptr = 2980 ipsec_getassocbyspi(ipsapp->ipsap_pbucket, 2981 assoc->sadb_sa_spi, srcaddr, dstaddr, af); 2982 mutex_exit(&ipsapp->ipsap_sa_ptr->ipsa_lock); 2983 mutex_exit(&outbound_bucket->isaf_lock); 2984 mutex_exit(&inbound_bucket->isaf_lock); 2985 return (ipsapp); 2986 } 2987 pair_spi = ipsapp->ipsap_sa_ptr->ipsa_otherspi; 2988 IPSA_COPY_ADDR(&pair_srcaddr, 2989 ipsapp->ipsap_sa_ptr->ipsa_srcaddr, af); 2990 IPSA_COPY_ADDR(&pair_dstaddr, 2991 ipsapp->ipsap_sa_ptr->ipsa_dstaddr, af); 2992 mutex_exit(&ipsapp->ipsap_sa_ptr->ipsa_lock); 2993 mutex_exit(&outbound_bucket->isaf_lock); 2994 mutex_exit(&inbound_bucket->isaf_lock); 2995 2996 if (pair_spi == 0) { 2997 ASSERT(ipsapp->ipsap_bucket != NULL); 2998 ASSERT(ipsapp->ipsap_pbucket != NULL); 2999 return (ipsapp); 3000 } 3001 3002 /* found sa in outbound sadb, peer should be inbound */ 3003 3004 if (in_inbound_table) { 3005 /* Found SA in inbound table, pair will be in outbound. */ 3006 if (af == AF_INET6) { 3007 ipsapp->ipsap_pbucket = OUTBOUND_BUCKET_V6(sp, 3008 *(uint32_t *)pair_srcaddr); 3009 } else { 3010 ipsapp->ipsap_pbucket = OUTBOUND_BUCKET_V4(sp, 3011 *(uint32_t *)pair_srcaddr); 3012 } 3013 } else { 3014 ipsapp->ipsap_pbucket = INBOUND_BUCKET(sp, pair_spi); 3015 } 3016 mutex_enter(&ipsapp->ipsap_pbucket->isaf_lock); 3017 ipsapp->ipsap_psa_ptr = ipsec_getassocbyspi(ipsapp->ipsap_pbucket, 3018 pair_spi, pair_dstaddr, pair_srcaddr, af); 3019 mutex_exit(&ipsapp->ipsap_pbucket->isaf_lock); 3020 ASSERT(ipsapp->ipsap_bucket != NULL); 3021 ASSERT(ipsapp->ipsap_pbucket != NULL); 3022 return (ipsapp); 3023 } 3024 3025 /* 3026 * Initialize the mechanism parameters associated with an SA. 3027 * These parameters can be shared by multiple packets, which saves 3028 * us from the overhead of consulting the algorithm table for 3029 * each packet. 3030 */ 3031 static void 3032 sadb_init_alginfo(ipsa_t *sa) 3033 { 3034 ipsec_alginfo_t *alg; 3035 ipsec_stack_t *ipss = sa->ipsa_netstack->netstack_ipsec; 3036 3037 mutex_enter(&ipss->ipsec_alg_lock); 3038 3039 if (sa->ipsa_encrkey != NULL) { 3040 alg = ipss->ipsec_alglists[IPSEC_ALG_ENCR][sa->ipsa_encr_alg]; 3041 if (alg != NULL && ALG_VALID(alg)) { 3042 sa->ipsa_emech.cm_type = alg->alg_mech_type; 3043 sa->ipsa_emech.cm_param = NULL; 3044 sa->ipsa_emech.cm_param_len = 0; 3045 sa->ipsa_iv_len = alg->alg_datalen; 3046 } else 3047 sa->ipsa_emech.cm_type = CRYPTO_MECHANISM_INVALID; 3048 } 3049 3050 if (sa->ipsa_authkey != NULL) { 3051 alg = ipss->ipsec_alglists[IPSEC_ALG_AUTH][sa->ipsa_auth_alg]; 3052 if (alg != NULL && ALG_VALID(alg)) { 3053 sa->ipsa_amech.cm_type = alg->alg_mech_type; 3054 sa->ipsa_amech.cm_param = (char *)&sa->ipsa_mac_len; 3055 sa->ipsa_amech.cm_param_len = sizeof (size_t); 3056 sa->ipsa_mac_len = (size_t)alg->alg_datalen; 3057 } else 3058 sa->ipsa_amech.cm_type = CRYPTO_MECHANISM_INVALID; 3059 } 3060 3061 mutex_exit(&ipss->ipsec_alg_lock); 3062 } 3063 3064 /* 3065 * Perform NAT-traversal cached checksum offset calculations here. 3066 */ 3067 static void 3068 sadb_nat_calculations(ipsa_t *newbie, sadb_address_t *natt_loc_ext, 3069 sadb_address_t *natt_rem_ext, uint32_t *src_addr_ptr, 3070 uint32_t *dst_addr_ptr) 3071 { 3072 struct sockaddr_in *natt_loc, *natt_rem; 3073 uint32_t *natt_loc_ptr = NULL, *natt_rem_ptr = NULL; 3074 uint32_t running_sum = 0; 3075 3076 #define DOWN_SUM(x) (x) = ((x) & 0xFFFF) + ((x) >> 16) 3077 3078 if (natt_rem_ext != NULL) { 3079 uint32_t l_src; 3080 uint32_t l_rem; 3081 3082 natt_rem = (struct sockaddr_in *)(natt_rem_ext + 1); 3083 3084 /* Ensured by sadb_addrfix(). */ 3085 ASSERT(natt_rem->sin_family == AF_INET); 3086 3087 natt_rem_ptr = (uint32_t *)(&natt_rem->sin_addr); 3088 newbie->ipsa_remote_nat_port = natt_rem->sin_port; 3089 l_src = *src_addr_ptr; 3090 l_rem = *natt_rem_ptr; 3091 3092 /* Instead of IPSA_COPY_ADDR(), just copy first 32 bits. */ 3093 newbie->ipsa_natt_addr_rem = *natt_rem_ptr; 3094 3095 l_src = ntohl(l_src); 3096 DOWN_SUM(l_src); 3097 DOWN_SUM(l_src); 3098 l_rem = ntohl(l_rem); 3099 DOWN_SUM(l_rem); 3100 DOWN_SUM(l_rem); 3101 3102 /* 3103 * We're 1's complement for checksums, so check for wraparound 3104 * here. 3105 */ 3106 if (l_rem > l_src) 3107 l_src--; 3108 3109 running_sum += l_src - l_rem; 3110 3111 DOWN_SUM(running_sum); 3112 DOWN_SUM(running_sum); 3113 } 3114 3115 if (natt_loc_ext != NULL) { 3116 natt_loc = (struct sockaddr_in *)(natt_loc_ext + 1); 3117 3118 /* Ensured by sadb_addrfix(). */ 3119 ASSERT(natt_loc->sin_family == AF_INET); 3120 3121 natt_loc_ptr = (uint32_t *)(&natt_loc->sin_addr); 3122 newbie->ipsa_local_nat_port = natt_loc->sin_port; 3123 3124 /* Instead of IPSA_COPY_ADDR(), just copy first 32 bits. */ 3125 newbie->ipsa_natt_addr_loc = *natt_loc_ptr; 3126 3127 /* 3128 * NAT-T port agility means we may have natt_loc_ext, but 3129 * only for a local-port change. 3130 */ 3131 if (natt_loc->sin_addr.s_addr != INADDR_ANY) { 3132 uint32_t l_dst = ntohl(*dst_addr_ptr); 3133 uint32_t l_loc = ntohl(*natt_loc_ptr); 3134 3135 DOWN_SUM(l_loc); 3136 DOWN_SUM(l_loc); 3137 DOWN_SUM(l_dst); 3138 DOWN_SUM(l_dst); 3139 3140 /* 3141 * We're 1's complement for checksums, so check for 3142 * wraparound here. 3143 */ 3144 if (l_loc > l_dst) 3145 l_dst--; 3146 3147 running_sum += l_dst - l_loc; 3148 DOWN_SUM(running_sum); 3149 DOWN_SUM(running_sum); 3150 } 3151 } 3152 3153 newbie->ipsa_inbound_cksum = running_sum; 3154 #undef DOWN_SUM 3155 } 3156 3157 /* 3158 * This function is called from consumers that need to insert a fully-grown 3159 * security association into its tables. This function takes into account that 3160 * SAs can be "inbound", "outbound", or "both". The "primary" and "secondary" 3161 * hash bucket parameters are set in order of what the SA will be most of the 3162 * time. (For example, an SA with an unspecified source, and a multicast 3163 * destination will primarily be an outbound SA. OTOH, if that destination 3164 * is unicast for this node, then the SA will primarily be inbound.) 3165 * 3166 * It takes a lot of parameters because even if clone is B_FALSE, this needs 3167 * to check both buckets for purposes of collision. 3168 * 3169 * Return 0 upon success. Return various errnos (ENOMEM, EEXIST) for 3170 * various error conditions. We may need to set samsg->sadb_x_msg_diagnostic 3171 * with additional diagnostic information because there is at least one EINVAL 3172 * case here. 3173 */ 3174 int 3175 sadb_common_add(queue_t *ip_q, queue_t *pfkey_q, mblk_t *mp, sadb_msg_t *samsg, 3176 keysock_in_t *ksi, isaf_t *primary, isaf_t *secondary, 3177 ipsa_t *newbie, boolean_t clone, boolean_t is_inbound, int *diagnostic, 3178 netstack_t *ns, sadbp_t *spp) 3179 { 3180 ipsa_t *newbie_clone = NULL, *scratch; 3181 ipsap_t *ipsapp = NULL; 3182 sadb_sa_t *assoc = (sadb_sa_t *)ksi->ks_in_extv[SADB_EXT_SA]; 3183 sadb_address_t *srcext = 3184 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_SRC]; 3185 sadb_address_t *dstext = 3186 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_DST]; 3187 sadb_address_t *isrcext = 3188 (sadb_address_t *)ksi->ks_in_extv[SADB_X_EXT_ADDRESS_INNER_SRC]; 3189 sadb_address_t *idstext = 3190 (sadb_address_t *)ksi->ks_in_extv[SADB_X_EXT_ADDRESS_INNER_DST]; 3191 sadb_x_kmc_t *kmcext = 3192 (sadb_x_kmc_t *)ksi->ks_in_extv[SADB_X_EXT_KM_COOKIE]; 3193 sadb_key_t *akey = (sadb_key_t *)ksi->ks_in_extv[SADB_EXT_KEY_AUTH]; 3194 sadb_key_t *ekey = (sadb_key_t *)ksi->ks_in_extv[SADB_EXT_KEY_ENCRYPT]; 3195 sadb_x_pair_t *pair_ext = 3196 (sadb_x_pair_t *)ksi->ks_in_extv[SADB_X_EXT_PAIR]; 3197 sadb_x_replay_ctr_t *replayext = 3198 (sadb_x_replay_ctr_t *)ksi->ks_in_extv[SADB_X_EXT_REPLAY_VALUE]; 3199 uint8_t protocol = 3200 (samsg->sadb_msg_satype == SADB_SATYPE_AH) ? IPPROTO_AH:IPPROTO_ESP; 3201 #if 0 3202 /* 3203 * XXXMLS - When Trusted Solaris or Multi-Level Secure functionality 3204 * comes to ON, examine these if 0'ed fragments. Look for XXXMLS. 3205 */ 3206 sadb_sens_t *sens = (sadb_sens_t *); 3207 #endif 3208 struct sockaddr_in *src, *dst, *isrc, *idst; 3209 struct sockaddr_in6 *src6, *dst6, *isrc6, *idst6; 3210 sadb_lifetime_t *soft = 3211 (sadb_lifetime_t *)ksi->ks_in_extv[SADB_EXT_LIFETIME_SOFT]; 3212 sadb_lifetime_t *hard = 3213 (sadb_lifetime_t *)ksi->ks_in_extv[SADB_EXT_LIFETIME_HARD]; 3214 sadb_lifetime_t *idle = 3215 (sadb_lifetime_t *)ksi->ks_in_extv[SADB_X_EXT_LIFETIME_IDLE]; 3216 sa_family_t af; 3217 int error = 0; 3218 boolean_t isupdate = (newbie != NULL); 3219 uint32_t *src_addr_ptr, *dst_addr_ptr, *isrc_addr_ptr, *idst_addr_ptr; 3220 mblk_t *ctl_mp = NULL; 3221 ipsec_stack_t *ipss = ns->netstack_ipsec; 3222 int rcode; 3223 3224 if (srcext == NULL) { 3225 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_SRC; 3226 return (EINVAL); 3227 } 3228 if (dstext == NULL) { 3229 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_DST; 3230 return (EINVAL); 3231 } 3232 if (assoc == NULL) { 3233 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_SA; 3234 return (EINVAL); 3235 } 3236 3237 src = (struct sockaddr_in *)(srcext + 1); 3238 src6 = (struct sockaddr_in6 *)(srcext + 1); 3239 dst = (struct sockaddr_in *)(dstext + 1); 3240 dst6 = (struct sockaddr_in6 *)(dstext + 1); 3241 if (isrcext != NULL) { 3242 isrc = (struct sockaddr_in *)(isrcext + 1); 3243 isrc6 = (struct sockaddr_in6 *)(isrcext + 1); 3244 ASSERT(idstext != NULL); 3245 idst = (struct sockaddr_in *)(idstext + 1); 3246 idst6 = (struct sockaddr_in6 *)(idstext + 1); 3247 } else { 3248 isrc = NULL; 3249 isrc6 = NULL; 3250 } 3251 3252 af = src->sin_family; 3253 3254 if (af == AF_INET) { 3255 src_addr_ptr = (uint32_t *)&src->sin_addr; 3256 dst_addr_ptr = (uint32_t *)&dst->sin_addr; 3257 } else { 3258 ASSERT(af == AF_INET6); 3259 src_addr_ptr = (uint32_t *)&src6->sin6_addr; 3260 dst_addr_ptr = (uint32_t *)&dst6->sin6_addr; 3261 } 3262 3263 if (!isupdate && (clone == B_TRUE || is_inbound == B_TRUE) && 3264 cl_inet_checkspi && 3265 (assoc->sadb_sa_state != SADB_X_SASTATE_ACTIVE_ELSEWHERE)) { 3266 rcode = cl_inet_checkspi(ns->netstack_stackid, protocol, 3267 assoc->sadb_sa_spi, NULL); 3268 if (rcode == -1) { 3269 return (EEXIST); 3270 } 3271 } 3272 3273 /* 3274 * Check to see if the new SA will be cloned AND paired. The 3275 * reason a SA will be cloned is the source or destination addresses 3276 * are not specific enough to determine if the SA goes in the outbound 3277 * or the inbound hash table, so its cloned and put in both. If 3278 * the SA is paired, it's soft linked to another SA for the other 3279 * direction. Keeping track and looking up SA's that are direction 3280 * unspecific and linked is too hard. 3281 */ 3282 if (clone && (pair_ext != NULL)) { 3283 *diagnostic = SADB_X_DIAGNOSTIC_PAIR_INAPPROPRIATE; 3284 return (EINVAL); 3285 } 3286 3287 if (!isupdate) { 3288 newbie = sadb_makelarvalassoc(assoc->sadb_sa_spi, 3289 src_addr_ptr, dst_addr_ptr, af, ns); 3290 if (newbie == NULL) 3291 return (ENOMEM); 3292 } 3293 3294 mutex_enter(&newbie->ipsa_lock); 3295 3296 if (isrc != NULL) { 3297 if (isrc->sin_family == AF_INET) { 3298 if (srcext->sadb_address_proto != IPPROTO_ENCAP) { 3299 if (srcext->sadb_address_proto != 0) { 3300 /* 3301 * Mismatched outer-packet protocol 3302 * and inner-packet address family. 3303 */ 3304 mutex_exit(&newbie->ipsa_lock); 3305 error = EPROTOTYPE; 3306 goto error; 3307 } else { 3308 /* Fill in with explicit protocol. */ 3309 srcext->sadb_address_proto = 3310 IPPROTO_ENCAP; 3311 dstext->sadb_address_proto = 3312 IPPROTO_ENCAP; 3313 } 3314 } 3315 isrc_addr_ptr = (uint32_t *)&isrc->sin_addr; 3316 idst_addr_ptr = (uint32_t *)&idst->sin_addr; 3317 } else { 3318 ASSERT(isrc->sin_family == AF_INET6); 3319 if (srcext->sadb_address_proto != IPPROTO_IPV6) { 3320 if (srcext->sadb_address_proto != 0) { 3321 /* 3322 * Mismatched outer-packet protocol 3323 * and inner-packet address family. 3324 */ 3325 mutex_exit(&newbie->ipsa_lock); 3326 error = EPROTOTYPE; 3327 goto error; 3328 } else { 3329 /* Fill in with explicit protocol. */ 3330 srcext->sadb_address_proto = 3331 IPPROTO_IPV6; 3332 dstext->sadb_address_proto = 3333 IPPROTO_IPV6; 3334 } 3335 } 3336 isrc_addr_ptr = (uint32_t *)&isrc6->sin6_addr; 3337 idst_addr_ptr = (uint32_t *)&idst6->sin6_addr; 3338 } 3339 newbie->ipsa_innerfam = isrc->sin_family; 3340 3341 IPSA_COPY_ADDR(newbie->ipsa_innersrc, isrc_addr_ptr, 3342 newbie->ipsa_innerfam); 3343 IPSA_COPY_ADDR(newbie->ipsa_innerdst, idst_addr_ptr, 3344 newbie->ipsa_innerfam); 3345 newbie->ipsa_innersrcpfx = isrcext->sadb_address_prefixlen; 3346 newbie->ipsa_innerdstpfx = idstext->sadb_address_prefixlen; 3347 3348 /* Unique value uses inner-ports for Tunnel Mode... */ 3349 newbie->ipsa_unique_id = SA_UNIQUE_ID(isrc->sin_port, 3350 idst->sin_port, dstext->sadb_address_proto, 3351 idstext->sadb_address_proto); 3352 newbie->ipsa_unique_mask = SA_UNIQUE_MASK(isrc->sin_port, 3353 idst->sin_port, dstext->sadb_address_proto, 3354 idstext->sadb_address_proto); 3355 } else { 3356 /* ... and outer-ports for Transport Mode. */ 3357 newbie->ipsa_unique_id = SA_UNIQUE_ID(src->sin_port, 3358 dst->sin_port, dstext->sadb_address_proto, 0); 3359 newbie->ipsa_unique_mask = SA_UNIQUE_MASK(src->sin_port, 3360 dst->sin_port, dstext->sadb_address_proto, 0); 3361 } 3362 if (newbie->ipsa_unique_mask != (uint64_t)0) 3363 newbie->ipsa_flags |= IPSA_F_UNIQUE; 3364 3365 sadb_nat_calculations(newbie, 3366 (sadb_address_t *)ksi->ks_in_extv[SADB_X_EXT_ADDRESS_NATT_LOC], 3367 (sadb_address_t *)ksi->ks_in_extv[SADB_X_EXT_ADDRESS_NATT_REM], 3368 src_addr_ptr, dst_addr_ptr); 3369 3370 newbie->ipsa_type = samsg->sadb_msg_satype; 3371 ASSERT((assoc->sadb_sa_state == SADB_SASTATE_MATURE) || 3372 (assoc->sadb_sa_state == SADB_X_SASTATE_ACTIVE_ELSEWHERE)); 3373 newbie->ipsa_auth_alg = assoc->sadb_sa_auth; 3374 newbie->ipsa_encr_alg = assoc->sadb_sa_encrypt; 3375 3376 newbie->ipsa_flags |= assoc->sadb_sa_flags; 3377 if ((newbie->ipsa_flags & SADB_X_SAFLAGS_NATT_LOC && 3378 ksi->ks_in_extv[SADB_X_EXT_ADDRESS_NATT_LOC] == NULL) || 3379 (newbie->ipsa_flags & SADB_X_SAFLAGS_NATT_REM && 3380 ksi->ks_in_extv[SADB_X_EXT_ADDRESS_NATT_REM] == NULL) || 3381 (newbie->ipsa_flags & SADB_X_SAFLAGS_TUNNEL && 3382 ksi->ks_in_extv[SADB_X_EXT_ADDRESS_INNER_SRC] == NULL)) { 3383 mutex_exit(&newbie->ipsa_lock); 3384 *diagnostic = SADB_X_DIAGNOSTIC_BAD_SAFLAGS; 3385 error = EINVAL; 3386 goto error; 3387 } 3388 /* 3389 * If unspecified source address, force replay_wsize to 0. 3390 * This is because an SA that has multiple sources of secure 3391 * traffic cannot enforce a replay counter w/o synchronizing the 3392 * senders. 3393 */ 3394 if (ksi->ks_in_srctype != KS_IN_ADDR_UNSPEC) 3395 newbie->ipsa_replay_wsize = assoc->sadb_sa_replay; 3396 else 3397 newbie->ipsa_replay_wsize = 0; 3398 3399 newbie->ipsa_addtime = gethrestime_sec(); 3400 3401 if (kmcext != NULL) { 3402 newbie->ipsa_kmp = kmcext->sadb_x_kmc_proto; 3403 newbie->ipsa_kmc = kmcext->sadb_x_kmc_cookie; 3404 } 3405 3406 /* 3407 * XXX CURRENT lifetime checks MAY BE needed for an UPDATE. 3408 * The spec says that one can update current lifetimes, but 3409 * that seems impractical, especially in the larval-to-mature 3410 * update that this function performs. 3411 */ 3412 if (soft != NULL) { 3413 newbie->ipsa_softaddlt = soft->sadb_lifetime_addtime; 3414 newbie->ipsa_softuselt = soft->sadb_lifetime_usetime; 3415 newbie->ipsa_softbyteslt = soft->sadb_lifetime_bytes; 3416 newbie->ipsa_softalloc = soft->sadb_lifetime_allocations; 3417 SET_EXPIRE(newbie, softaddlt, softexpiretime); 3418 } 3419 if (hard != NULL) { 3420 newbie->ipsa_hardaddlt = hard->sadb_lifetime_addtime; 3421 newbie->ipsa_harduselt = hard->sadb_lifetime_usetime; 3422 newbie->ipsa_hardbyteslt = hard->sadb_lifetime_bytes; 3423 newbie->ipsa_hardalloc = hard->sadb_lifetime_allocations; 3424 SET_EXPIRE(newbie, hardaddlt, hardexpiretime); 3425 } 3426 if (idle != NULL) { 3427 newbie->ipsa_idleaddlt = idle->sadb_lifetime_addtime; 3428 newbie->ipsa_idleuselt = idle->sadb_lifetime_usetime; 3429 newbie->ipsa_idleexpiretime = newbie->ipsa_addtime + 3430 newbie->ipsa_idleaddlt; 3431 newbie->ipsa_idletime = newbie->ipsa_idleaddlt; 3432 } 3433 3434 newbie->ipsa_authtmpl = NULL; 3435 newbie->ipsa_encrtmpl = NULL; 3436 3437 if (akey != NULL) { 3438 newbie->ipsa_authkeybits = akey->sadb_key_bits; 3439 newbie->ipsa_authkeylen = SADB_1TO8(akey->sadb_key_bits); 3440 /* In case we have to round up to the next byte... */ 3441 if ((akey->sadb_key_bits & 0x7) != 0) 3442 newbie->ipsa_authkeylen++; 3443 newbie->ipsa_authkey = kmem_alloc(newbie->ipsa_authkeylen, 3444 KM_NOSLEEP); 3445 if (newbie->ipsa_authkey == NULL) { 3446 error = ENOMEM; 3447 mutex_exit(&newbie->ipsa_lock); 3448 goto error; 3449 } 3450 bcopy(akey + 1, newbie->ipsa_authkey, newbie->ipsa_authkeylen); 3451 bzero(akey + 1, newbie->ipsa_authkeylen); 3452 3453 /* 3454 * Pre-initialize the kernel crypto framework key 3455 * structure. 3456 */ 3457 newbie->ipsa_kcfauthkey.ck_format = CRYPTO_KEY_RAW; 3458 newbie->ipsa_kcfauthkey.ck_length = newbie->ipsa_authkeybits; 3459 newbie->ipsa_kcfauthkey.ck_data = newbie->ipsa_authkey; 3460 3461 mutex_enter(&ipss->ipsec_alg_lock); 3462 error = ipsec_create_ctx_tmpl(newbie, IPSEC_ALG_AUTH); 3463 mutex_exit(&ipss->ipsec_alg_lock); 3464 if (error != 0) { 3465 mutex_exit(&newbie->ipsa_lock); 3466 goto error; 3467 } 3468 } 3469 3470 if (ekey != NULL) { 3471 newbie->ipsa_encrkeybits = ekey->sadb_key_bits; 3472 newbie->ipsa_encrkeylen = SADB_1TO8(ekey->sadb_key_bits); 3473 /* In case we have to round up to the next byte... */ 3474 if ((ekey->sadb_key_bits & 0x7) != 0) 3475 newbie->ipsa_encrkeylen++; 3476 newbie->ipsa_encrkey = kmem_alloc(newbie->ipsa_encrkeylen, 3477 KM_NOSLEEP); 3478 if (newbie->ipsa_encrkey == NULL) { 3479 error = ENOMEM; 3480 mutex_exit(&newbie->ipsa_lock); 3481 goto error; 3482 } 3483 bcopy(ekey + 1, newbie->ipsa_encrkey, newbie->ipsa_encrkeylen); 3484 /* XXX is this safe w.r.t db_ref, etc? */ 3485 bzero(ekey + 1, newbie->ipsa_encrkeylen); 3486 3487 /* 3488 * Pre-initialize the kernel crypto framework key 3489 * structure. 3490 */ 3491 newbie->ipsa_kcfencrkey.ck_format = CRYPTO_KEY_RAW; 3492 newbie->ipsa_kcfencrkey.ck_length = newbie->ipsa_encrkeybits; 3493 newbie->ipsa_kcfencrkey.ck_data = newbie->ipsa_encrkey; 3494 3495 mutex_enter(&ipss->ipsec_alg_lock); 3496 error = ipsec_create_ctx_tmpl(newbie, IPSEC_ALG_ENCR); 3497 mutex_exit(&ipss->ipsec_alg_lock); 3498 if (error != 0) { 3499 mutex_exit(&newbie->ipsa_lock); 3500 goto error; 3501 } 3502 } 3503 3504 sadb_init_alginfo(newbie); 3505 3506 /* 3507 * Ptrs to processing functions. 3508 */ 3509 if (newbie->ipsa_type == SADB_SATYPE_ESP) 3510 ipsecesp_init_funcs(newbie); 3511 else 3512 ipsecah_init_funcs(newbie); 3513 ASSERT(newbie->ipsa_output_func != NULL && 3514 newbie->ipsa_input_func != NULL); 3515 3516 /* 3517 * Certificate ID stuff. 3518 */ 3519 if (ksi->ks_in_extv[SADB_EXT_IDENTITY_SRC] != NULL) { 3520 sadb_ident_t *id = 3521 (sadb_ident_t *)ksi->ks_in_extv[SADB_EXT_IDENTITY_SRC]; 3522 3523 /* 3524 * Can assume strlen() will return okay because ext_check() in 3525 * keysock.c prepares the string for us. 3526 */ 3527 newbie->ipsa_src_cid = ipsid_lookup(id->sadb_ident_type, 3528 (char *)(id+1), ns); 3529 if (newbie->ipsa_src_cid == NULL) { 3530 error = ENOMEM; 3531 mutex_exit(&newbie->ipsa_lock); 3532 goto error; 3533 } 3534 } 3535 3536 if (ksi->ks_in_extv[SADB_EXT_IDENTITY_DST] != NULL) { 3537 sadb_ident_t *id = 3538 (sadb_ident_t *)ksi->ks_in_extv[SADB_EXT_IDENTITY_DST]; 3539 3540 /* 3541 * Can assume strlen() will return okay because ext_check() in 3542 * keysock.c prepares the string for us. 3543 */ 3544 newbie->ipsa_dst_cid = ipsid_lookup(id->sadb_ident_type, 3545 (char *)(id+1), ns); 3546 if (newbie->ipsa_dst_cid == NULL) { 3547 error = ENOMEM; 3548 mutex_exit(&newbie->ipsa_lock); 3549 goto error; 3550 } 3551 } 3552 3553 #if 0 3554 /* XXXMLS SENSITIVITY handling code. */ 3555 if (sens != NULL) { 3556 int i; 3557 uint64_t *bitmap = (uint64_t *)(sens + 1); 3558 3559 newbie->ipsa_dpd = sens->sadb_sens_dpd; 3560 newbie->ipsa_senslevel = sens->sadb_sens_sens_level; 3561 newbie->ipsa_integlevel = sens->sadb_sens_integ_level; 3562 newbie->ipsa_senslen = SADB_64TO8(sens->sadb_sens_sens_len); 3563 newbie->ipsa_integlen = SADB_64TO8(sens->sadb_sens_integ_len); 3564 newbie->ipsa_integ = kmem_alloc(newbie->ipsa_integlen, 3565 KM_NOSLEEP); 3566 if (newbie->ipsa_integ == NULL) { 3567 error = ENOMEM; 3568 mutex_exit(&newbie->ipsa_lock); 3569 goto error; 3570 } 3571 newbie->ipsa_sens = kmem_alloc(newbie->ipsa_senslen, 3572 KM_NOSLEEP); 3573 if (newbie->ipsa_sens == NULL) { 3574 error = ENOMEM; 3575 mutex_exit(&newbie->ipsa_lock); 3576 goto error; 3577 } 3578 for (i = 0; i < sens->sadb_sens_sens_len; i++) { 3579 newbie->ipsa_sens[i] = *bitmap; 3580 bitmap++; 3581 } 3582 for (i = 0; i < sens->sadb_sens_integ_len; i++) { 3583 newbie->ipsa_integ[i] = *bitmap; 3584 bitmap++; 3585 } 3586 } 3587 3588 #endif 3589 3590 if (replayext != NULL) { 3591 if ((replayext->sadb_x_rc_replay32 == 0) && 3592 (replayext->sadb_x_rc_replay64 != 0)) { 3593 error = EOPNOTSUPP; 3594 mutex_exit(&newbie->ipsa_lock); 3595 goto error; 3596 } 3597 newbie->ipsa_replay = replayext->sadb_x_rc_replay32; 3598 } 3599 3600 /* now that the SA has been updated, set its new state */ 3601 newbie->ipsa_state = assoc->sadb_sa_state; 3602 3603 if (clone) { 3604 newbie->ipsa_haspeer = B_TRUE; 3605 } else { 3606 if (!is_inbound) { 3607 lifetime_fuzz(newbie); 3608 } 3609 } 3610 /* 3611 * The less locks I hold when doing an insertion and possible cloning, 3612 * the better! 3613 */ 3614 mutex_exit(&newbie->ipsa_lock); 3615 3616 if (clone) { 3617 newbie_clone = sadb_cloneassoc(newbie); 3618 3619 if (newbie_clone == NULL) { 3620 error = ENOMEM; 3621 goto error; 3622 } 3623 } 3624 3625 /* 3626 * Enter the bucket locks. The order of entry is outbound, 3627 * inbound. We map "primary" and "secondary" into outbound and inbound 3628 * based on the destination address type. If the destination address 3629 * type is for a node that isn't mine (or potentially mine), the 3630 * "primary" bucket is the outbound one. 3631 */ 3632 if (!is_inbound) { 3633 /* primary == outbound */ 3634 mutex_enter(&primary->isaf_lock); 3635 mutex_enter(&secondary->isaf_lock); 3636 } else { 3637 /* primary == inbound */ 3638 mutex_enter(&secondary->isaf_lock); 3639 mutex_enter(&primary->isaf_lock); 3640 } 3641 3642 IPSECHW_DEBUG(IPSECHW_SADB, ("sadb_common_add: spi = 0x%x\n", 3643 newbie->ipsa_spi)); 3644 3645 /* 3646 * sadb_insertassoc() doesn't increment the reference 3647 * count. We therefore have to increment the 3648 * reference count one more time to reflect the 3649 * pointers of the table that reference this SA. 3650 */ 3651 IPSA_REFHOLD(newbie); 3652 3653 if (isupdate) { 3654 /* 3655 * Unlink from larval holding cell in the "inbound" fanout. 3656 */ 3657 ASSERT(newbie->ipsa_linklock == &primary->isaf_lock || 3658 newbie->ipsa_linklock == &secondary->isaf_lock); 3659 sadb_unlinkassoc(newbie); 3660 } 3661 3662 mutex_enter(&newbie->ipsa_lock); 3663 error = sadb_insertassoc(newbie, primary); 3664 if (error == 0) { 3665 ctl_mp = sadb_fmt_sa_req(DL_CO_SET, newbie->ipsa_type, newbie, 3666 is_inbound); 3667 } 3668 mutex_exit(&newbie->ipsa_lock); 3669 3670 if (error != 0) { 3671 /* 3672 * Since sadb_insertassoc() failed, we must decrement the 3673 * refcount again so the cleanup code will actually free 3674 * the offending SA. 3675 */ 3676 IPSA_REFRELE(newbie); 3677 goto error_unlock; 3678 } 3679 3680 if (newbie_clone != NULL) { 3681 mutex_enter(&newbie_clone->ipsa_lock); 3682 error = sadb_insertassoc(newbie_clone, secondary); 3683 mutex_exit(&newbie_clone->ipsa_lock); 3684 if (error != 0) { 3685 /* Collision in secondary table. */ 3686 sadb_unlinkassoc(newbie); /* This does REFRELE. */ 3687 goto error_unlock; 3688 } 3689 IPSA_REFHOLD(newbie_clone); 3690 } else { 3691 ASSERT(primary != secondary); 3692 scratch = ipsec_getassocbyspi(secondary, newbie->ipsa_spi, 3693 ALL_ZEROES_PTR, newbie->ipsa_dstaddr, af); 3694 if (scratch != NULL) { 3695 /* Collision in secondary table. */ 3696 sadb_unlinkassoc(newbie); /* This does REFRELE. */ 3697 /* Set the error, since ipsec_getassocbyspi() can't. */ 3698 error = EEXIST; 3699 goto error_unlock; 3700 } 3701 } 3702 3703 /* OKAY! So let's do some reality check assertions. */ 3704 3705 ASSERT(MUTEX_NOT_HELD(&newbie->ipsa_lock)); 3706 ASSERT(newbie_clone == NULL || 3707 (MUTEX_NOT_HELD(&newbie_clone->ipsa_lock))); 3708 /* 3709 * If hardware acceleration could happen, send it. 3710 */ 3711 if (ctl_mp != NULL) { 3712 putnext(ip_q, ctl_mp); 3713 ctl_mp = NULL; 3714 } 3715 3716 error_unlock: 3717 3718 /* 3719 * We can exit the locks in any order. Only entrance needs to 3720 * follow any protocol. 3721 */ 3722 mutex_exit(&secondary->isaf_lock); 3723 mutex_exit(&primary->isaf_lock); 3724 3725 if (pair_ext != NULL && error == 0) { 3726 /* update pair_spi if it exists. */ 3727 ipsapp = get_ipsa_pair(assoc, srcext, dstext, spp); 3728 if (ipsapp == NULL) { 3729 error = ESRCH; 3730 *diagnostic = SADB_X_DIAGNOSTIC_PAIR_SA_NOTFOUND; 3731 } else if (ipsapp->ipsap_psa_ptr != NULL) { 3732 *diagnostic = SADB_X_DIAGNOSTIC_PAIR_ALREADY; 3733 error = EINVAL; 3734 } else { 3735 /* update_pairing() sets diagnostic */ 3736 error = update_pairing(ipsapp, ksi, diagnostic, spp); 3737 } 3738 } 3739 /* Common error point for this routine. */ 3740 error: 3741 if (newbie != NULL) { 3742 if (error != 0) { 3743 /* This SA is broken, let the reaper clean up. */ 3744 mutex_enter(&newbie->ipsa_lock); 3745 newbie->ipsa_state = IPSA_STATE_DEAD; 3746 newbie->ipsa_hardexpiretime = 1; 3747 mutex_exit(&newbie->ipsa_lock); 3748 } 3749 IPSA_REFRELE(newbie); 3750 } 3751 if (newbie_clone != NULL) { 3752 IPSA_REFRELE(newbie_clone); 3753 } 3754 if (ctl_mp != NULL) 3755 freemsg(ctl_mp); 3756 3757 if (error == 0) { 3758 /* 3759 * Construct favorable PF_KEY return message and send to 3760 * keysock. Update the flags in the original keysock message 3761 * to reflect the actual flags in the new SA. 3762 * (Q: Do I need to pass "newbie"? If I do, 3763 * make sure to REFHOLD, call, then REFRELE.) 3764 */ 3765 assoc->sadb_sa_flags = newbie->ipsa_flags; 3766 sadb_pfkey_echo(pfkey_q, mp, samsg, ksi, NULL); 3767 } 3768 3769 destroy_ipsa_pair(ipsapp); 3770 return (error); 3771 } 3772 3773 /* 3774 * Set the time of first use for a security association. Update any 3775 * expiration times as a result. 3776 */ 3777 void 3778 sadb_set_usetime(ipsa_t *assoc) 3779 { 3780 time_t snapshot = gethrestime_sec(); 3781 3782 mutex_enter(&assoc->ipsa_lock); 3783 assoc->ipsa_lastuse = snapshot; 3784 assoc->ipsa_idleexpiretime = snapshot + assoc->ipsa_idletime; 3785 3786 /* 3787 * Caller does check usetime before calling me usually, and 3788 * double-checking is better than a mutex_enter/exit hit. 3789 */ 3790 if (assoc->ipsa_usetime == 0) { 3791 /* 3792 * This is redundant for outbound SA's, as 3793 * ipsec_getassocbyconn() sets the IPSA_F_USED flag already. 3794 * Inbound SAs, however, have no such protection. 3795 */ 3796 assoc->ipsa_flags |= IPSA_F_USED; 3797 assoc->ipsa_usetime = snapshot; 3798 3799 /* 3800 * After setting the use time, see if we have a use lifetime 3801 * that would cause the actual SA expiration time to shorten. 3802 */ 3803 UPDATE_EXPIRE(assoc, softuselt, softexpiretime); 3804 UPDATE_EXPIRE(assoc, harduselt, hardexpiretime); 3805 } 3806 mutex_exit(&assoc->ipsa_lock); 3807 } 3808 3809 /* 3810 * Send up a PF_KEY expire message for this association. 3811 */ 3812 static void 3813 sadb_expire_assoc(queue_t *pfkey_q, ipsa_t *assoc) 3814 { 3815 mblk_t *mp, *mp1; 3816 int alloclen, af; 3817 sadb_msg_t *samsg; 3818 sadb_lifetime_t *current, *expire; 3819 sadb_sa_t *saext; 3820 uint8_t *end; 3821 boolean_t tunnel_mode; 3822 3823 ASSERT(MUTEX_HELD(&assoc->ipsa_lock)); 3824 3825 /* Don't bother sending if there's no queue. */ 3826 if (pfkey_q == NULL) 3827 return; 3828 3829 /* If the SA is one of a pair, only SOFT expire the OUTBOUND SA */ 3830 if (assoc->ipsa_state == IPSA_STATE_DYING && 3831 (assoc->ipsa_flags & IPSA_F_PAIRED) && 3832 !(assoc->ipsa_flags & IPSA_F_OUTBOUND)) { 3833 return; 3834 } 3835 3836 mp = sadb_keysock_out(0); 3837 if (mp == NULL) { 3838 /* cmn_err(CE_WARN, */ 3839 /* "sadb_expire_assoc: Can't allocate KEYSOCK_OUT.\n"); */ 3840 return; 3841 } 3842 3843 alloclen = sizeof (*samsg) + sizeof (*current) + sizeof (*expire) + 3844 2 * sizeof (sadb_address_t) + sizeof (*saext); 3845 3846 af = assoc->ipsa_addrfam; 3847 switch (af) { 3848 case AF_INET: 3849 alloclen += 2 * sizeof (struct sockaddr_in); 3850 break; 3851 case AF_INET6: 3852 alloclen += 2 * sizeof (struct sockaddr_in6); 3853 break; 3854 default: 3855 /* Won't happen unless there's a kernel bug. */ 3856 freeb(mp); 3857 cmn_err(CE_WARN, 3858 "sadb_expire_assoc: Unknown address length.\n"); 3859 return; 3860 } 3861 3862 tunnel_mode = (assoc->ipsa_flags & IPSA_F_TUNNEL); 3863 if (tunnel_mode) { 3864 alloclen += 2 * sizeof (sadb_address_t); 3865 switch (assoc->ipsa_innerfam) { 3866 case AF_INET: 3867 alloclen += 2 * sizeof (struct sockaddr_in); 3868 break; 3869 case AF_INET6: 3870 alloclen += 2 * sizeof (struct sockaddr_in6); 3871 break; 3872 default: 3873 /* Won't happen unless there's a kernel bug. */ 3874 freeb(mp); 3875 cmn_err(CE_WARN, "sadb_expire_assoc: " 3876 "Unknown inner address length.\n"); 3877 return; 3878 } 3879 } 3880 3881 mp->b_cont = allocb(alloclen, BPRI_HI); 3882 if (mp->b_cont == NULL) { 3883 freeb(mp); 3884 /* cmn_err(CE_WARN, */ 3885 /* "sadb_expire_assoc: Can't allocate message.\n"); */ 3886 return; 3887 } 3888 3889 mp1 = mp; 3890 mp = mp->b_cont; 3891 end = mp->b_wptr + alloclen; 3892 3893 samsg = (sadb_msg_t *)mp->b_wptr; 3894 mp->b_wptr += sizeof (*samsg); 3895 samsg->sadb_msg_version = PF_KEY_V2; 3896 samsg->sadb_msg_type = SADB_EXPIRE; 3897 samsg->sadb_msg_errno = 0; 3898 samsg->sadb_msg_satype = assoc->ipsa_type; 3899 samsg->sadb_msg_len = SADB_8TO64(alloclen); 3900 samsg->sadb_msg_reserved = 0; 3901 samsg->sadb_msg_seq = 0; 3902 samsg->sadb_msg_pid = 0; 3903 3904 saext = (sadb_sa_t *)mp->b_wptr; 3905 mp->b_wptr += sizeof (*saext); 3906 saext->sadb_sa_len = SADB_8TO64(sizeof (*saext)); 3907 saext->sadb_sa_exttype = SADB_EXT_SA; 3908 saext->sadb_sa_spi = assoc->ipsa_spi; 3909 saext->sadb_sa_replay = assoc->ipsa_replay_wsize; 3910 saext->sadb_sa_state = assoc->ipsa_state; 3911 saext->sadb_sa_auth = assoc->ipsa_auth_alg; 3912 saext->sadb_sa_encrypt = assoc->ipsa_encr_alg; 3913 saext->sadb_sa_flags = assoc->ipsa_flags; 3914 3915 current = (sadb_lifetime_t *)mp->b_wptr; 3916 mp->b_wptr += sizeof (sadb_lifetime_t); 3917 current->sadb_lifetime_len = SADB_8TO64(sizeof (*current)); 3918 current->sadb_lifetime_exttype = SADB_EXT_LIFETIME_CURRENT; 3919 /* We do not support the concept. */ 3920 current->sadb_lifetime_allocations = 0; 3921 current->sadb_lifetime_bytes = assoc->ipsa_bytes; 3922 current->sadb_lifetime_addtime = assoc->ipsa_addtime; 3923 current->sadb_lifetime_usetime = assoc->ipsa_usetime; 3924 3925 expire = (sadb_lifetime_t *)mp->b_wptr; 3926 mp->b_wptr += sizeof (*expire); 3927 expire->sadb_lifetime_len = SADB_8TO64(sizeof (*expire)); 3928 3929 if (assoc->ipsa_state == IPSA_STATE_DEAD) { 3930 expire->sadb_lifetime_exttype = SADB_EXT_LIFETIME_HARD; 3931 expire->sadb_lifetime_allocations = assoc->ipsa_hardalloc; 3932 expire->sadb_lifetime_bytes = assoc->ipsa_hardbyteslt; 3933 expire->sadb_lifetime_addtime = assoc->ipsa_hardaddlt; 3934 expire->sadb_lifetime_usetime = assoc->ipsa_harduselt; 3935 } else if (assoc->ipsa_state == IPSA_STATE_DYING) { 3936 expire->sadb_lifetime_exttype = SADB_EXT_LIFETIME_SOFT; 3937 expire->sadb_lifetime_allocations = assoc->ipsa_softalloc; 3938 expire->sadb_lifetime_bytes = assoc->ipsa_softbyteslt; 3939 expire->sadb_lifetime_addtime = assoc->ipsa_softaddlt; 3940 expire->sadb_lifetime_usetime = assoc->ipsa_softuselt; 3941 } else { 3942 ASSERT(assoc->ipsa_state == IPSA_STATE_MATURE); 3943 expire->sadb_lifetime_exttype = SADB_X_EXT_LIFETIME_IDLE; 3944 expire->sadb_lifetime_allocations = 0; 3945 expire->sadb_lifetime_bytes = 0; 3946 expire->sadb_lifetime_addtime = assoc->ipsa_idleaddlt; 3947 expire->sadb_lifetime_usetime = assoc->ipsa_idleuselt; 3948 } 3949 3950 mp->b_wptr = sadb_make_addr_ext(mp->b_wptr, end, SADB_EXT_ADDRESS_SRC, 3951 af, assoc->ipsa_srcaddr, tunnel_mode ? 0 : SA_SRCPORT(assoc), 3952 SA_PROTO(assoc), 0); 3953 ASSERT(mp->b_wptr != NULL); 3954 3955 mp->b_wptr = sadb_make_addr_ext(mp->b_wptr, end, SADB_EXT_ADDRESS_DST, 3956 af, assoc->ipsa_dstaddr, tunnel_mode ? 0 : SA_DSTPORT(assoc), 3957 SA_PROTO(assoc), 0); 3958 ASSERT(mp->b_wptr != NULL); 3959 3960 if (tunnel_mode) { 3961 mp->b_wptr = sadb_make_addr_ext(mp->b_wptr, end, 3962 SADB_X_EXT_ADDRESS_INNER_SRC, assoc->ipsa_innerfam, 3963 assoc->ipsa_innersrc, SA_SRCPORT(assoc), SA_IPROTO(assoc), 3964 assoc->ipsa_innersrcpfx); 3965 ASSERT(mp->b_wptr != NULL); 3966 mp->b_wptr = sadb_make_addr_ext(mp->b_wptr, end, 3967 SADB_X_EXT_ADDRESS_INNER_DST, assoc->ipsa_innerfam, 3968 assoc->ipsa_innerdst, SA_DSTPORT(assoc), SA_IPROTO(assoc), 3969 assoc->ipsa_innerdstpfx); 3970 ASSERT(mp->b_wptr != NULL); 3971 } 3972 3973 /* Can just putnext, we're ready to go! */ 3974 putnext(pfkey_q, mp1); 3975 } 3976 3977 /* 3978 * "Age" the SA with the number of bytes that was used to protect traffic. 3979 * Send an SADB_EXPIRE message if appropriate. Return B_TRUE if there was 3980 * enough "charge" left in the SA to protect the data. Return B_FALSE 3981 * otherwise. (If B_FALSE is returned, the association either was, or became 3982 * DEAD.) 3983 */ 3984 boolean_t 3985 sadb_age_bytes(queue_t *pfkey_q, ipsa_t *assoc, uint64_t bytes, 3986 boolean_t sendmsg) 3987 { 3988 boolean_t rc = B_TRUE; 3989 uint64_t newtotal; 3990 3991 mutex_enter(&assoc->ipsa_lock); 3992 newtotal = assoc->ipsa_bytes + bytes; 3993 if (assoc->ipsa_hardbyteslt != 0 && 3994 newtotal >= assoc->ipsa_hardbyteslt) { 3995 if (assoc->ipsa_state != IPSA_STATE_DEAD) { 3996 sadb_delete_cluster(assoc); 3997 /* 3998 * Send EXPIRE message to PF_KEY. May wish to pawn 3999 * this off on another non-interrupt thread. Also 4000 * unlink this SA immediately. 4001 */ 4002 assoc->ipsa_state = IPSA_STATE_DEAD; 4003 if (sendmsg) 4004 sadb_expire_assoc(pfkey_q, assoc); 4005 /* 4006 * Set non-zero expiration time so sadb_age_assoc() 4007 * will work when reaping. 4008 */ 4009 assoc->ipsa_hardexpiretime = (time_t)1; 4010 } /* Else someone beat me to it! */ 4011 rc = B_FALSE; 4012 } else if (assoc->ipsa_softbyteslt != 0 && 4013 (newtotal >= assoc->ipsa_softbyteslt)) { 4014 if (assoc->ipsa_state < IPSA_STATE_DYING) { 4015 /* 4016 * Send EXPIRE message to PF_KEY. May wish to pawn 4017 * this off on another non-interrupt thread. 4018 */ 4019 assoc->ipsa_state = IPSA_STATE_DYING; 4020 assoc->ipsa_bytes = newtotal; 4021 if (sendmsg) 4022 sadb_expire_assoc(pfkey_q, assoc); 4023 } /* Else someone beat me to it! */ 4024 } 4025 if (rc == B_TRUE) 4026 assoc->ipsa_bytes = newtotal; 4027 mutex_exit(&assoc->ipsa_lock); 4028 return (rc); 4029 } 4030 4031 /* 4032 * Push one or more DL_CO_DELETE messages queued up by 4033 * sadb_torch_assoc down to the underlying driver now that it's a 4034 * convenient time for it (i.e., ipsa bucket locks not held). 4035 */ 4036 static void 4037 sadb_drain_torchq(queue_t *q, mblk_t *mp) 4038 { 4039 while (mp != NULL) { 4040 mblk_t *next = mp->b_next; 4041 mp->b_next = NULL; 4042 if (q != NULL) 4043 putnext(q, mp); 4044 else 4045 freemsg(mp); 4046 mp = next; 4047 } 4048 } 4049 4050 /* 4051 * "Torch" an individual SA. Returns NULL, so it can be tail-called from 4052 * sadb_age_assoc(). 4053 * 4054 * If SA is hardware-accelerated, and we can't allocate the mblk 4055 * containing the DL_CO_DELETE, just return; it will remain in the 4056 * table and be swept up by sadb_ager() in a subsequent pass. 4057 */ 4058 static ipsa_t * 4059 sadb_torch_assoc(isaf_t *head, ipsa_t *sa, boolean_t inbnd, mblk_t **mq) 4060 { 4061 mblk_t *mp; 4062 4063 ASSERT(MUTEX_HELD(&head->isaf_lock)); 4064 ASSERT(MUTEX_HELD(&sa->ipsa_lock)); 4065 ASSERT(sa->ipsa_state == IPSA_STATE_DEAD); 4066 4067 /* 4068 * Force cached SAs to be revalidated.. 4069 */ 4070 head->isaf_gen++; 4071 4072 if (sa->ipsa_flags & IPSA_F_HW) { 4073 mp = sadb_fmt_sa_req(DL_CO_DELETE, sa->ipsa_type, sa, inbnd); 4074 if (mp == NULL) { 4075 mutex_exit(&sa->ipsa_lock); 4076 return (NULL); 4077 } 4078 mp->b_next = *mq; 4079 *mq = mp; 4080 } 4081 mutex_exit(&sa->ipsa_lock); 4082 sadb_unlinkassoc(sa); 4083 4084 return (NULL); 4085 } 4086 4087 /* 4088 * Do various SA-is-idle activities depending on delta (the number of idle 4089 * seconds on the SA) and/or other properties of the SA. 4090 * 4091 * Return B_TRUE if I've sent a packet, because I have to drop the 4092 * association's mutex before sending a packet out the wire. 4093 */ 4094 /* ARGSUSED */ 4095 static boolean_t 4096 sadb_idle_activities(ipsa_t *assoc, time_t delta, boolean_t inbound) 4097 { 4098 ipsecesp_stack_t *espstack = assoc->ipsa_netstack->netstack_ipsecesp; 4099 int nat_t_interval = espstack->ipsecesp_nat_keepalive_interval; 4100 4101 ASSERT(MUTEX_HELD(&assoc->ipsa_lock)); 4102 4103 if (!inbound && (assoc->ipsa_flags & IPSA_F_NATT_LOC) && 4104 delta >= nat_t_interval && 4105 gethrestime_sec() - assoc->ipsa_last_nat_t_ka >= nat_t_interval) { 4106 ASSERT(assoc->ipsa_type == SADB_SATYPE_ESP); 4107 assoc->ipsa_last_nat_t_ka = gethrestime_sec(); 4108 mutex_exit(&assoc->ipsa_lock); 4109 ipsecesp_send_keepalive(assoc); 4110 return (B_TRUE); 4111 } 4112 return (B_FALSE); 4113 } 4114 4115 /* 4116 * Return "assoc" if haspeer is true and I send an expire. This allows 4117 * the consumers' aging functions to tidy up an expired SA's peer. 4118 */ 4119 static ipsa_t * 4120 sadb_age_assoc(isaf_t *head, queue_t *pfkey_q, ipsa_t *assoc, 4121 time_t current, int reap_delay, boolean_t inbound, mblk_t **mq) 4122 { 4123 ipsa_t *retval = NULL; 4124 boolean_t dropped_mutex = B_FALSE; 4125 4126 ASSERT(MUTEX_HELD(&head->isaf_lock)); 4127 4128 mutex_enter(&assoc->ipsa_lock); 4129 4130 if (((assoc->ipsa_state == IPSA_STATE_LARVAL) || 4131 ((assoc->ipsa_state == IPSA_STATE_IDLE) || 4132 (assoc->ipsa_state == IPSA_STATE_ACTIVE_ELSEWHERE) && 4133 (assoc->ipsa_hardexpiretime != 0))) && 4134 (assoc->ipsa_hardexpiretime <= current)) { 4135 assoc->ipsa_state = IPSA_STATE_DEAD; 4136 return (sadb_torch_assoc(head, assoc, inbound, mq)); 4137 } 4138 4139 /* 4140 * Check lifetimes. Fortunately, SA setup is done 4141 * such that there are only two times to look at, 4142 * softexpiretime, and hardexpiretime. 4143 * 4144 * Check hard first. 4145 */ 4146 4147 if (assoc->ipsa_hardexpiretime != 0 && 4148 assoc->ipsa_hardexpiretime <= current) { 4149 if (assoc->ipsa_state == IPSA_STATE_DEAD) 4150 return (sadb_torch_assoc(head, assoc, inbound, mq)); 4151 4152 if (inbound) { 4153 sadb_delete_cluster(assoc); 4154 } 4155 4156 /* 4157 * Send SADB_EXPIRE with hard lifetime, delay for unlinking. 4158 */ 4159 assoc->ipsa_state = IPSA_STATE_DEAD; 4160 if (assoc->ipsa_haspeer || assoc->ipsa_otherspi != 0) { 4161 /* 4162 * If the SA is paired or peered with another, put 4163 * a copy on a list which can be processed later, the 4164 * pair/peer SA needs to be updated so the both die 4165 * at the same time. 4166 * 4167 * If I return assoc, I have to bump up its reference 4168 * count to keep with the ipsa_t reference count 4169 * semantics. 4170 */ 4171 IPSA_REFHOLD(assoc); 4172 retval = assoc; 4173 } 4174 sadb_expire_assoc(pfkey_q, assoc); 4175 assoc->ipsa_hardexpiretime = current + reap_delay; 4176 } else if (assoc->ipsa_softexpiretime != 0 && 4177 assoc->ipsa_softexpiretime <= current && 4178 assoc->ipsa_state < IPSA_STATE_DYING) { 4179 /* 4180 * Send EXPIRE message to PF_KEY. May wish to pawn 4181 * this off on another non-interrupt thread. 4182 */ 4183 assoc->ipsa_state = IPSA_STATE_DYING; 4184 if (assoc->ipsa_haspeer) { 4185 /* 4186 * If the SA has a peer, update the peer's state 4187 * on SOFT_EXPIRE, this is mostly to prevent two 4188 * expire messages from effectively the same SA. 4189 * 4190 * Don't care about paired SA's, then can (and should) 4191 * be able to soft expire at different times. 4192 * 4193 * If I return assoc, I have to bump up its 4194 * reference count to keep with the ipsa_t reference 4195 * count semantics. 4196 */ 4197 IPSA_REFHOLD(assoc); 4198 retval = assoc; 4199 } 4200 sadb_expire_assoc(pfkey_q, assoc); 4201 } else if (assoc->ipsa_idletime != 0 && 4202 assoc->ipsa_idleexpiretime <= current) { 4203 if (assoc->ipsa_state == IPSA_STATE_ACTIVE_ELSEWHERE) { 4204 assoc->ipsa_state = IPSA_STATE_IDLE; 4205 } 4206 4207 /* 4208 * Need to handle Mature case 4209 */ 4210 if (assoc->ipsa_state == IPSA_STATE_MATURE) { 4211 sadb_expire_assoc(pfkey_q, assoc); 4212 } 4213 } else { 4214 /* Check idle time activities. */ 4215 dropped_mutex = sadb_idle_activities(assoc, 4216 current - assoc->ipsa_lastuse, inbound); 4217 } 4218 4219 if (!dropped_mutex) 4220 mutex_exit(&assoc->ipsa_lock); 4221 return (retval); 4222 } 4223 4224 /* 4225 * Called by a consumer protocol to do ther dirty work of reaping dead 4226 * Security Associations. 4227 * 4228 * NOTE: sadb_age_assoc() marks expired SA's as DEAD but only removed 4229 * SA's that are already marked DEAD, so expired SA's are only reaped 4230 * the second time sadb_ager() runs. 4231 */ 4232 void 4233 sadb_ager(sadb_t *sp, queue_t *pfkey_q, queue_t *ip_q, int reap_delay, 4234 netstack_t *ns) 4235 { 4236 int i; 4237 isaf_t *bucket; 4238 ipsa_t *assoc, *spare; 4239 iacqf_t *acqlist; 4240 ipsacq_t *acqrec, *spareacq; 4241 templist_t *haspeerlist, *newbie; 4242 /* Snapshot current time now. */ 4243 time_t current = gethrestime_sec(); 4244 mblk_t *mq = NULL; 4245 haspeerlist = NULL; 4246 4247 /* 4248 * Do my dirty work. This includes aging real entries, aging 4249 * larvals, and aging outstanding ACQUIREs. 4250 * 4251 * I hope I don't tie up resources for too long. 4252 */ 4253 4254 /* Age acquires. */ 4255 4256 for (i = 0; i < sp->sdb_hashsize; i++) { 4257 acqlist = &sp->sdb_acq[i]; 4258 mutex_enter(&acqlist->iacqf_lock); 4259 for (acqrec = acqlist->iacqf_ipsacq; acqrec != NULL; 4260 acqrec = spareacq) { 4261 spareacq = acqrec->ipsacq_next; 4262 if (current > acqrec->ipsacq_expire) 4263 sadb_destroy_acquire(acqrec, ns); 4264 } 4265 mutex_exit(&acqlist->iacqf_lock); 4266 } 4267 4268 /* Age inbound associations. */ 4269 for (i = 0; i < sp->sdb_hashsize; i++) { 4270 bucket = &(sp->sdb_if[i]); 4271 mutex_enter(&bucket->isaf_lock); 4272 for (assoc = bucket->isaf_ipsa; assoc != NULL; 4273 assoc = spare) { 4274 spare = assoc->ipsa_next; 4275 if (sadb_age_assoc(bucket, pfkey_q, assoc, current, 4276 reap_delay, B_TRUE, &mq) != NULL) { 4277 /* 4278 * Put SA's which have a peer or SA's which 4279 * are paired on a list for processing after 4280 * all the hash tables have been walked. 4281 * 4282 * sadb_age_assoc() increments the refcnt, 4283 * effectively doing an IPSA_REFHOLD(). 4284 */ 4285 newbie = kmem_alloc(sizeof (*newbie), 4286 KM_NOSLEEP); 4287 if (newbie == NULL) { 4288 /* 4289 * Don't forget to REFRELE(). 4290 */ 4291 IPSA_REFRELE(assoc); 4292 continue; /* for loop... */ 4293 } 4294 newbie->next = haspeerlist; 4295 newbie->ipsa = assoc; 4296 haspeerlist = newbie; 4297 } 4298 } 4299 mutex_exit(&bucket->isaf_lock); 4300 } 4301 4302 if (mq != NULL) { 4303 sadb_drain_torchq(ip_q, mq); 4304 mq = NULL; 4305 } 4306 age_pair_peer_list(haspeerlist, sp, B_FALSE); 4307 haspeerlist = NULL; 4308 4309 /* Age outbound associations. */ 4310 for (i = 0; i < sp->sdb_hashsize; i++) { 4311 bucket = &(sp->sdb_of[i]); 4312 mutex_enter(&bucket->isaf_lock); 4313 for (assoc = bucket->isaf_ipsa; assoc != NULL; 4314 assoc = spare) { 4315 spare = assoc->ipsa_next; 4316 if (sadb_age_assoc(bucket, pfkey_q, assoc, current, 4317 reap_delay, B_FALSE, &mq) != NULL) { 4318 /* 4319 * sadb_age_assoc() increments the refcnt, 4320 * effectively doing an IPSA_REFHOLD(). 4321 */ 4322 newbie = kmem_alloc(sizeof (*newbie), 4323 KM_NOSLEEP); 4324 if (newbie == NULL) { 4325 /* 4326 * Don't forget to REFRELE(). 4327 */ 4328 IPSA_REFRELE(assoc); 4329 continue; /* for loop... */ 4330 } 4331 newbie->next = haspeerlist; 4332 newbie->ipsa = assoc; 4333 haspeerlist = newbie; 4334 } 4335 } 4336 mutex_exit(&bucket->isaf_lock); 4337 } 4338 if (mq != NULL) { 4339 sadb_drain_torchq(ip_q, mq); 4340 mq = NULL; 4341 } 4342 4343 age_pair_peer_list(haspeerlist, sp, B_TRUE); 4344 4345 /* 4346 * Run a GC pass to clean out dead identities. 4347 */ 4348 ipsid_gc(ns); 4349 } 4350 4351 /* 4352 * Figure out when to reschedule the ager. 4353 */ 4354 timeout_id_t 4355 sadb_retimeout(hrtime_t begin, queue_t *pfkey_q, void (*ager)(void *), 4356 void *agerarg, uint_t *intp, uint_t intmax, short mid) 4357 { 4358 hrtime_t end = gethrtime(); 4359 uint_t interval = *intp; 4360 4361 /* 4362 * See how long this took. If it took too long, increase the 4363 * aging interval. 4364 */ 4365 if ((end - begin) > (hrtime_t)interval * (hrtime_t)1000000) { 4366 if (interval >= intmax) { 4367 /* XXX Rate limit this? Or recommend flush? */ 4368 (void) strlog(mid, 0, 0, SL_ERROR | SL_WARN, 4369 "Too many SA's to age out in %d msec.\n", 4370 intmax); 4371 } else { 4372 /* Double by shifting by one bit. */ 4373 interval <<= 1; 4374 interval = min(interval, intmax); 4375 } 4376 } else if ((end - begin) <= (hrtime_t)interval * (hrtime_t)500000 && 4377 interval > SADB_AGE_INTERVAL_DEFAULT) { 4378 /* 4379 * If I took less than half of the interval, then I should 4380 * ratchet the interval back down. Never automatically 4381 * shift below the default aging interval. 4382 * 4383 * NOTE:This even overrides manual setting of the age 4384 * interval using NDD to lower the setting past the 4385 * default. In other words, if you set the interval 4386 * lower than the default, and your SADB gets too big, 4387 * the interval will only self-lower back to the default. 4388 */ 4389 /* Halve by shifting one bit. */ 4390 interval >>= 1; 4391 interval = max(interval, SADB_AGE_INTERVAL_DEFAULT); 4392 } 4393 *intp = interval; 4394 return (qtimeout(pfkey_q, ager, agerarg, 4395 drv_usectohz(interval * 1000))); 4396 } 4397 4398 4399 /* 4400 * Update the lifetime values of an SA. This is the path an SADB_UPDATE 4401 * message takes when updating a MATURE or DYING SA. 4402 */ 4403 static void 4404 sadb_update_lifetimes(ipsa_t *assoc, sadb_lifetime_t *hard, 4405 sadb_lifetime_t *soft, sadb_lifetime_t *idle, boolean_t outbound) 4406 { 4407 mutex_enter(&assoc->ipsa_lock); 4408 4409 /* 4410 * XXX RFC 2367 mentions how an SADB_EXT_LIFETIME_CURRENT can be 4411 * passed in during an update message. We currently don't handle 4412 * these. 4413 */ 4414 4415 if (hard != NULL) { 4416 if (hard->sadb_lifetime_bytes != 0) 4417 assoc->ipsa_hardbyteslt = hard->sadb_lifetime_bytes; 4418 if (hard->sadb_lifetime_usetime != 0) 4419 assoc->ipsa_harduselt = hard->sadb_lifetime_usetime; 4420 if (hard->sadb_lifetime_addtime != 0) 4421 assoc->ipsa_hardaddlt = hard->sadb_lifetime_addtime; 4422 if (assoc->ipsa_hardaddlt != 0) { 4423 assoc->ipsa_hardexpiretime = 4424 assoc->ipsa_addtime + assoc->ipsa_hardaddlt; 4425 } 4426 if (assoc->ipsa_harduselt != 0 && 4427 assoc->ipsa_flags & IPSA_F_USED) { 4428 UPDATE_EXPIRE(assoc, harduselt, hardexpiretime); 4429 } 4430 if (hard->sadb_lifetime_allocations != 0) 4431 assoc->ipsa_hardalloc = hard->sadb_lifetime_allocations; 4432 } 4433 4434 if (soft != NULL) { 4435 if (soft->sadb_lifetime_bytes != 0) { 4436 if (soft->sadb_lifetime_bytes > 4437 assoc->ipsa_hardbyteslt) { 4438 assoc->ipsa_softbyteslt = 4439 assoc->ipsa_hardbyteslt; 4440 } else { 4441 assoc->ipsa_softbyteslt = 4442 soft->sadb_lifetime_bytes; 4443 } 4444 } 4445 if (soft->sadb_lifetime_usetime != 0) { 4446 if (soft->sadb_lifetime_usetime > 4447 assoc->ipsa_harduselt) { 4448 assoc->ipsa_softuselt = 4449 assoc->ipsa_harduselt; 4450 } else { 4451 assoc->ipsa_softuselt = 4452 soft->sadb_lifetime_usetime; 4453 } 4454 } 4455 if (soft->sadb_lifetime_addtime != 0) { 4456 if (soft->sadb_lifetime_addtime > 4457 assoc->ipsa_hardexpiretime) { 4458 assoc->ipsa_softexpiretime = 4459 assoc->ipsa_hardexpiretime; 4460 } else { 4461 assoc->ipsa_softaddlt = 4462 soft->sadb_lifetime_addtime; 4463 } 4464 } 4465 if (assoc->ipsa_softaddlt != 0) { 4466 assoc->ipsa_softexpiretime = 4467 assoc->ipsa_addtime + assoc->ipsa_softaddlt; 4468 } 4469 if (assoc->ipsa_softuselt != 0 && 4470 assoc->ipsa_flags & IPSA_F_USED) { 4471 UPDATE_EXPIRE(assoc, softuselt, softexpiretime); 4472 } 4473 if (outbound && assoc->ipsa_softexpiretime != 0) { 4474 if (assoc->ipsa_state == IPSA_STATE_MATURE) 4475 lifetime_fuzz(assoc); 4476 } 4477 4478 if (soft->sadb_lifetime_allocations != 0) 4479 assoc->ipsa_softalloc = soft->sadb_lifetime_allocations; 4480 } 4481 4482 if (idle != NULL) { 4483 time_t current = gethrestime_sec(); 4484 if ((assoc->ipsa_idleexpiretime <= current) && 4485 (assoc->ipsa_idleaddlt == idle->sadb_lifetime_addtime)) { 4486 assoc->ipsa_idleexpiretime = 4487 current + assoc->ipsa_idleaddlt; 4488 } 4489 if (idle->sadb_lifetime_addtime != 0) 4490 assoc->ipsa_idleaddlt = idle->sadb_lifetime_addtime; 4491 if (idle->sadb_lifetime_usetime != 0) 4492 assoc->ipsa_idleuselt = idle->sadb_lifetime_usetime; 4493 if (assoc->ipsa_idleaddlt != 0) { 4494 assoc->ipsa_idleexpiretime = 4495 current + idle->sadb_lifetime_addtime; 4496 assoc->ipsa_idletime = idle->sadb_lifetime_addtime; 4497 } 4498 if (assoc->ipsa_idleuselt != 0) { 4499 if (assoc->ipsa_idletime != 0) { 4500 assoc->ipsa_idletime = min(assoc->ipsa_idletime, 4501 assoc->ipsa_idleuselt); 4502 assoc->ipsa_idleexpiretime = 4503 current + assoc->ipsa_idletime; 4504 } else { 4505 assoc->ipsa_idleexpiretime = 4506 current + assoc->ipsa_idleuselt; 4507 assoc->ipsa_idletime = assoc->ipsa_idleuselt; 4508 } 4509 } 4510 } 4511 mutex_exit(&assoc->ipsa_lock); 4512 } 4513 4514 static int 4515 sadb_update_state(ipsa_t *assoc, uint_t new_state, mblk_t **ipkt_lst) 4516 { 4517 int rcode = 0; 4518 time_t current = gethrestime_sec(); 4519 4520 mutex_enter(&assoc->ipsa_lock); 4521 4522 switch (new_state) { 4523 case SADB_X_SASTATE_ACTIVE_ELSEWHERE: 4524 if (assoc->ipsa_state == SADB_X_SASTATE_IDLE) { 4525 assoc->ipsa_state = IPSA_STATE_ACTIVE_ELSEWHERE; 4526 assoc->ipsa_idleexpiretime = 4527 current + assoc->ipsa_idletime; 4528 } 4529 break; 4530 case SADB_X_SASTATE_IDLE: 4531 if (assoc->ipsa_state == SADB_X_SASTATE_ACTIVE_ELSEWHERE) { 4532 assoc->ipsa_state = IPSA_STATE_IDLE; 4533 assoc->ipsa_idleexpiretime = 4534 current + assoc->ipsa_idletime; 4535 } else { 4536 rcode = EINVAL; 4537 } 4538 break; 4539 4540 case SADB_X_SASTATE_ACTIVE: 4541 if (assoc->ipsa_state != SADB_X_SASTATE_IDLE) { 4542 rcode = EINVAL; 4543 break; 4544 } 4545 assoc->ipsa_state = IPSA_STATE_MATURE; 4546 assoc->ipsa_idleexpiretime = current + assoc->ipsa_idletime; 4547 4548 if (ipkt_lst == NULL) { 4549 break; 4550 } 4551 4552 if (assoc->ipsa_bpkt_head != NULL) { 4553 *ipkt_lst = assoc->ipsa_bpkt_head; 4554 assoc->ipsa_bpkt_head = assoc->ipsa_bpkt_tail = NULL; 4555 assoc->ipsa_mblkcnt = 0; 4556 } else { 4557 *ipkt_lst = NULL; 4558 } 4559 break; 4560 default: 4561 rcode = EINVAL; 4562 break; 4563 } 4564 4565 mutex_exit(&assoc->ipsa_lock); 4566 return (rcode); 4567 } 4568 4569 /* 4570 * Common code to update an SA. 4571 */ 4572 4573 int 4574 sadb_update_sa(mblk_t *mp, keysock_in_t *ksi, mblk_t **ipkt_lst, 4575 sadbp_t *spp, int *diagnostic, queue_t *pfkey_q, 4576 int (*add_sa_func)(mblk_t *, keysock_in_t *, int *, netstack_t *), 4577 netstack_t *ns, uint8_t sadb_msg_type) 4578 { 4579 sadb_sa_t *assoc = (sadb_sa_t *)ksi->ks_in_extv[SADB_EXT_SA]; 4580 sadb_address_t *srcext = 4581 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_SRC]; 4582 sadb_address_t *dstext = 4583 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_DST]; 4584 sadb_x_kmc_t *kmcext = 4585 (sadb_x_kmc_t *)ksi->ks_in_extv[SADB_X_EXT_KM_COOKIE]; 4586 sadb_key_t *akey = (sadb_key_t *)ksi->ks_in_extv[SADB_EXT_KEY_AUTH]; 4587 sadb_key_t *ekey = (sadb_key_t *)ksi->ks_in_extv[SADB_EXT_KEY_ENCRYPT]; 4588 sadb_x_replay_ctr_t *replext = 4589 (sadb_x_replay_ctr_t *)ksi->ks_in_extv[SADB_X_EXT_REPLAY_VALUE]; 4590 sadb_lifetime_t *soft = 4591 (sadb_lifetime_t *)ksi->ks_in_extv[SADB_EXT_LIFETIME_SOFT]; 4592 sadb_lifetime_t *hard = 4593 (sadb_lifetime_t *)ksi->ks_in_extv[SADB_EXT_LIFETIME_HARD]; 4594 sadb_lifetime_t *idle = 4595 (sadb_lifetime_t *)ksi->ks_in_extv[SADB_X_EXT_LIFETIME_IDLE]; 4596 sadb_x_pair_t *pair_ext = 4597 (sadb_x_pair_t *)ksi->ks_in_extv[SADB_X_EXT_PAIR]; 4598 ipsa_t *echo_target = NULL; 4599 int error = 0; 4600 ipsap_t *ipsapp = NULL; 4601 uint32_t kmp = 0, kmc = 0; 4602 time_t current = gethrestime_sec(); 4603 4604 4605 /* I need certain extensions present for either UPDATE message. */ 4606 if (srcext == NULL) { 4607 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_SRC; 4608 return (EINVAL); 4609 } 4610 if (dstext == NULL) { 4611 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_DST; 4612 return (EINVAL); 4613 } 4614 if (assoc == NULL) { 4615 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_SA; 4616 return (EINVAL); 4617 } 4618 4619 if (kmcext != NULL) { 4620 kmp = kmcext->sadb_x_kmc_proto; 4621 kmc = kmcext->sadb_x_kmc_cookie; 4622 } 4623 4624 ipsapp = get_ipsa_pair(assoc, srcext, dstext, spp); 4625 if (ipsapp == NULL) { 4626 *diagnostic = SADB_X_DIAGNOSTIC_SA_NOTFOUND; 4627 return (ESRCH); 4628 } 4629 4630 if (ipsapp->ipsap_psa_ptr == NULL && ipsapp->ipsap_sa_ptr != NULL) { 4631 if (ipsapp->ipsap_sa_ptr->ipsa_state == IPSA_STATE_LARVAL) { 4632 /* 4633 * REFRELE the target and let the add_sa_func() 4634 * deal with updating a larval SA. 4635 */ 4636 destroy_ipsa_pair(ipsapp); 4637 return (add_sa_func(mp, ksi, diagnostic, ns)); 4638 } 4639 } 4640 4641 if (assoc->sadb_sa_state == SADB_X_SASTATE_ACTIVE_ELSEWHERE) { 4642 if (ipsapp->ipsap_sa_ptr != NULL && 4643 ipsapp->ipsap_sa_ptr->ipsa_state == IPSA_STATE_IDLE) { 4644 if ((error = sadb_update_state(ipsapp->ipsap_sa_ptr, 4645 assoc->sadb_sa_state, NULL)) != 0) { 4646 *diagnostic = SADB_X_DIAGNOSTIC_BAD_SASTATE; 4647 goto bail; 4648 } 4649 } 4650 if (ipsapp->ipsap_psa_ptr != NULL && 4651 ipsapp->ipsap_psa_ptr->ipsa_state == IPSA_STATE_IDLE) { 4652 if ((error = sadb_update_state(ipsapp->ipsap_psa_ptr, 4653 assoc->sadb_sa_state, NULL)) != 0) { 4654 *diagnostic = SADB_X_DIAGNOSTIC_BAD_SASTATE; 4655 goto bail; 4656 } 4657 } 4658 } 4659 if (assoc->sadb_sa_state == SADB_X_SASTATE_ACTIVE) { 4660 if (ipsapp->ipsap_sa_ptr != NULL) { 4661 error = sadb_update_state(ipsapp->ipsap_sa_ptr, 4662 assoc->sadb_sa_state, 4663 (ipsapp->ipsap_sa_ptr->ipsa_flags & 4664 IPSA_F_INBOUND) ? ipkt_lst : NULL); 4665 if (error) { 4666 *diagnostic = SADB_X_DIAGNOSTIC_BAD_SASTATE; 4667 goto bail; 4668 } 4669 } 4670 if (ipsapp->ipsap_psa_ptr != NULL) { 4671 error = sadb_update_state(ipsapp->ipsap_psa_ptr, 4672 assoc->sadb_sa_state, 4673 (ipsapp->ipsap_psa_ptr->ipsa_flags & 4674 IPSA_F_INBOUND) ? ipkt_lst : NULL); 4675 if (error) { 4676 *diagnostic = SADB_X_DIAGNOSTIC_BAD_SASTATE; 4677 goto bail; 4678 } 4679 } 4680 sadb_pfkey_echo(pfkey_q, mp, (sadb_msg_t *)mp->b_cont->b_rptr, 4681 ksi, echo_target); 4682 goto bail; 4683 } 4684 4685 /* 4686 * Reality checks for updates of active associations. 4687 * Sundry first-pass UPDATE-specific reality checks. 4688 * Have to do the checks here, because it's after the add_sa code. 4689 * XXX STATS : logging/stats here? 4690 */ 4691 4692 if (!((assoc->sadb_sa_state == SADB_SASTATE_MATURE) || 4693 (assoc->sadb_sa_state == SADB_X_SASTATE_ACTIVE_ELSEWHERE))) { 4694 *diagnostic = SADB_X_DIAGNOSTIC_BAD_SASTATE; 4695 error = EINVAL; 4696 goto bail; 4697 } 4698 4699 if (assoc->sadb_sa_flags & ~spp->s_updateflags) { 4700 *diagnostic = SADB_X_DIAGNOSTIC_BAD_SAFLAGS; 4701 error = EINVAL; 4702 goto bail; 4703 } 4704 4705 if (ksi->ks_in_extv[SADB_EXT_LIFETIME_CURRENT] != NULL) { 4706 error = EOPNOTSUPP; 4707 goto bail; 4708 } 4709 4710 if ((*diagnostic = sadb_hardsoftchk(hard, soft, idle)) != 0) { 4711 error = EINVAL; 4712 goto bail; 4713 } 4714 if (akey != NULL) { 4715 *diagnostic = SADB_X_DIAGNOSTIC_AKEY_PRESENT; 4716 error = EINVAL; 4717 goto bail; 4718 } 4719 if (ekey != NULL) { 4720 *diagnostic = SADB_X_DIAGNOSTIC_EKEY_PRESENT; 4721 error = EINVAL; 4722 goto bail; 4723 } 4724 4725 if (ipsapp->ipsap_sa_ptr != NULL) { 4726 if (ipsapp->ipsap_sa_ptr->ipsa_state == IPSA_STATE_DEAD) { 4727 error = ESRCH; /* DEAD == Not there, in this case. */ 4728 *diagnostic = SADB_X_DIAGNOSTIC_SA_EXPIRED; 4729 goto bail; 4730 } 4731 if ((kmp != 0) && 4732 ((ipsapp->ipsap_sa_ptr->ipsa_kmp != 0) || 4733 (ipsapp->ipsap_sa_ptr->ipsa_kmp != kmp))) { 4734 *diagnostic = SADB_X_DIAGNOSTIC_DUPLICATE_KMP; 4735 error = EINVAL; 4736 goto bail; 4737 } 4738 if ((kmc != 0) && 4739 ((ipsapp->ipsap_sa_ptr->ipsa_kmc != 0) || 4740 (ipsapp->ipsap_sa_ptr->ipsa_kmc != kmc))) { 4741 *diagnostic = SADB_X_DIAGNOSTIC_DUPLICATE_KMC; 4742 error = EINVAL; 4743 goto bail; 4744 } 4745 /* 4746 * Do not allow replay value change for MATURE or LARVAL SA. 4747 */ 4748 4749 if ((replext != NULL) && 4750 ((ipsapp->ipsap_sa_ptr->ipsa_state == IPSA_STATE_LARVAL) || 4751 (ipsapp->ipsap_sa_ptr->ipsa_state == IPSA_STATE_MATURE))) { 4752 *diagnostic = SADB_X_DIAGNOSTIC_BAD_SASTATE; 4753 error = EINVAL; 4754 goto bail; 4755 } 4756 } 4757 4758 if (ipsapp->ipsap_psa_ptr != NULL) { 4759 if (ipsapp->ipsap_psa_ptr->ipsa_state == IPSA_STATE_DEAD) { 4760 *diagnostic = SADB_X_DIAGNOSTIC_SA_EXPIRED; 4761 error = ESRCH; /* DEAD == Not there, in this case. */ 4762 goto bail; 4763 } 4764 if ((kmp != 0) && 4765 ((ipsapp->ipsap_psa_ptr->ipsa_kmp != 0) || 4766 (ipsapp->ipsap_psa_ptr->ipsa_kmp != kmp))) { 4767 *diagnostic = SADB_X_DIAGNOSTIC_DUPLICATE_KMP; 4768 error = EINVAL; 4769 goto bail; 4770 } 4771 if ((kmc != 0) && 4772 ((ipsapp->ipsap_psa_ptr->ipsa_kmc != 0) || 4773 (ipsapp->ipsap_psa_ptr->ipsa_kmc != kmc))) { 4774 *diagnostic = SADB_X_DIAGNOSTIC_DUPLICATE_KMC; 4775 error = EINVAL; 4776 goto bail; 4777 } 4778 } 4779 4780 if (ipsapp->ipsap_sa_ptr != NULL) { 4781 sadb_update_lifetimes(ipsapp->ipsap_sa_ptr, hard, soft, 4782 idle, B_TRUE); 4783 if (kmp != 0) 4784 ipsapp->ipsap_sa_ptr->ipsa_kmp = kmp; 4785 if (kmc != 0) 4786 ipsapp->ipsap_sa_ptr->ipsa_kmc = kmc; 4787 if ((replext != NULL) && 4788 (ipsapp->ipsap_sa_ptr->ipsa_replay_wsize != 0)) { 4789 /* 4790 * If an inbound SA, update the replay counter 4791 * and check off all the other sequence number 4792 */ 4793 if (ksi->ks_in_dsttype == KS_IN_ADDR_ME) { 4794 if (!sadb_replay_check(ipsapp->ipsap_sa_ptr, 4795 replext->sadb_x_rc_replay32)) { 4796 error = EINVAL; 4797 goto bail; 4798 } 4799 mutex_enter(&ipsapp->ipsap_sa_ptr->ipsa_lock); 4800 ipsapp->ipsap_sa_ptr->ipsa_idleexpiretime = 4801 current + 4802 ipsapp->ipsap_sa_ptr->ipsa_idletime; 4803 mutex_exit(&ipsapp->ipsap_sa_ptr->ipsa_lock); 4804 } else { 4805 mutex_enter(&ipsapp->ipsap_sa_ptr->ipsa_lock); 4806 ipsapp->ipsap_sa_ptr->ipsa_replay = 4807 replext->sadb_x_rc_replay32; 4808 ipsapp->ipsap_sa_ptr->ipsa_idleexpiretime = 4809 current + 4810 ipsapp->ipsap_sa_ptr->ipsa_idletime; 4811 mutex_exit(&ipsapp->ipsap_sa_ptr->ipsa_lock); 4812 } 4813 } 4814 } 4815 4816 if (sadb_msg_type == SADB_X_UPDATEPAIR) { 4817 if (ipsapp->ipsap_psa_ptr != NULL) { 4818 sadb_update_lifetimes(ipsapp->ipsap_psa_ptr, hard, soft, 4819 idle, B_FALSE); 4820 if (kmp != 0) 4821 ipsapp->ipsap_psa_ptr->ipsa_kmp = kmp; 4822 if (kmc != 0) 4823 ipsapp->ipsap_psa_ptr->ipsa_kmc = kmc; 4824 } else { 4825 *diagnostic = SADB_X_DIAGNOSTIC_PAIR_SA_NOTFOUND; 4826 error = ESRCH; 4827 goto bail; 4828 } 4829 } 4830 4831 if (pair_ext != NULL) 4832 error = update_pairing(ipsapp, ksi, diagnostic, spp); 4833 4834 if (error == 0) 4835 sadb_pfkey_echo(pfkey_q, mp, (sadb_msg_t *)mp->b_cont->b_rptr, 4836 ksi, echo_target); 4837 bail: 4838 4839 destroy_ipsa_pair(ipsapp); 4840 4841 return (error); 4842 } 4843 4844 4845 int 4846 update_pairing(ipsap_t *ipsapp, keysock_in_t *ksi, int *diagnostic, 4847 sadbp_t *spp) 4848 { 4849 sadb_sa_t *assoc = (sadb_sa_t *)ksi->ks_in_extv[SADB_EXT_SA]; 4850 sadb_address_t *srcext = 4851 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_SRC]; 4852 sadb_address_t *dstext = 4853 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_DST]; 4854 sadb_x_pair_t *pair_ext = 4855 (sadb_x_pair_t *)ksi->ks_in_extv[SADB_X_EXT_PAIR]; 4856 int error = 0; 4857 ipsap_t *oipsapp = NULL; 4858 boolean_t undo_pair = B_FALSE; 4859 uint32_t ipsa_flags; 4860 4861 if (pair_ext->sadb_x_pair_spi == 0 || pair_ext->sadb_x_pair_spi == 4862 assoc->sadb_sa_spi) { 4863 *diagnostic = SADB_X_DIAGNOSTIC_PAIR_INAPPROPRIATE; 4864 return (EINVAL); 4865 } 4866 4867 /* 4868 * Assume for now that the spi value provided in the SADB_UPDATE 4869 * message was valid, update the SA with its pair spi value. 4870 * If the spi turns out to be bogus or the SA no longer exists 4871 * then this will be detected when the reverse update is made 4872 * below. 4873 */ 4874 mutex_enter(&ipsapp->ipsap_sa_ptr->ipsa_lock); 4875 ipsapp->ipsap_sa_ptr->ipsa_flags |= IPSA_F_PAIRED; 4876 ipsapp->ipsap_sa_ptr->ipsa_otherspi = pair_ext->sadb_x_pair_spi; 4877 mutex_exit(&ipsapp->ipsap_sa_ptr->ipsa_lock); 4878 4879 /* 4880 * After updating the ipsa_otherspi element of the SA, get_ipsa_pair() 4881 * should now return pointers to the SA *AND* its pair, if this is not 4882 * the case, the "otherspi" either did not exist or was deleted. Also 4883 * check that "otherspi" is not already paired. If everything looks 4884 * good, complete the update. IPSA_REFRELE the first pair_pointer 4885 * after this update to ensure its not deleted until we are done. 4886 */ 4887 oipsapp = get_ipsa_pair(assoc, srcext, dstext, spp); 4888 if (oipsapp == NULL) { 4889 /* 4890 * This should never happen, calling function still has 4891 * IPSA_REFHELD on the SA we just updated. 4892 */ 4893 *diagnostic = SADB_X_DIAGNOSTIC_PAIR_SA_NOTFOUND; 4894 return (EINVAL); 4895 } 4896 4897 if (oipsapp->ipsap_psa_ptr == NULL) { 4898 *diagnostic = SADB_X_DIAGNOSTIC_PAIR_INAPPROPRIATE; 4899 undo_pair = B_TRUE; 4900 } else { 4901 ipsa_flags = oipsapp->ipsap_psa_ptr->ipsa_flags; 4902 if ((oipsapp->ipsap_psa_ptr->ipsa_state == IPSA_STATE_DEAD) || 4903 (oipsapp->ipsap_psa_ptr->ipsa_state == IPSA_STATE_DYING)) { 4904 /* Its dead Jim! */ 4905 *diagnostic = SADB_X_DIAGNOSTIC_PAIR_INAPPROPRIATE; 4906 undo_pair = B_TRUE; 4907 } else if ((ipsa_flags & (IPSA_F_OUTBOUND | IPSA_F_INBOUND)) == 4908 (IPSA_F_OUTBOUND | IPSA_F_INBOUND)) { 4909 /* This SA is in both hashtables. */ 4910 *diagnostic = SADB_X_DIAGNOSTIC_PAIR_INAPPROPRIATE; 4911 undo_pair = B_TRUE; 4912 } else if (ipsa_flags & IPSA_F_PAIRED) { 4913 /* This SA is already paired with another. */ 4914 *diagnostic = SADB_X_DIAGNOSTIC_PAIR_ALREADY; 4915 undo_pair = B_TRUE; 4916 } 4917 } 4918 4919 if (undo_pair) { 4920 /* The pair SA does not exist. */ 4921 mutex_enter(&ipsapp->ipsap_sa_ptr->ipsa_lock); 4922 ipsapp->ipsap_sa_ptr->ipsa_flags &= ~IPSA_F_PAIRED; 4923 ipsapp->ipsap_sa_ptr->ipsa_otherspi = 0; 4924 mutex_exit(&ipsapp->ipsap_sa_ptr->ipsa_lock); 4925 error = EINVAL; 4926 } else { 4927 mutex_enter(&oipsapp->ipsap_psa_ptr->ipsa_lock); 4928 oipsapp->ipsap_psa_ptr->ipsa_otherspi = assoc->sadb_sa_spi; 4929 oipsapp->ipsap_psa_ptr->ipsa_flags |= IPSA_F_PAIRED; 4930 mutex_exit(&oipsapp->ipsap_psa_ptr->ipsa_lock); 4931 } 4932 4933 destroy_ipsa_pair(oipsapp); 4934 return (error); 4935 } 4936 4937 /* 4938 * The following functions deal with ACQUIRE LISTS. An ACQUIRE list is 4939 * a list of outstanding SADB_ACQUIRE messages. If ipsec_getassocbyconn() fails 4940 * for an outbound datagram, that datagram is queued up on an ACQUIRE record, 4941 * and an SADB_ACQUIRE message is sent up. Presumably, a user-space key 4942 * management daemon will process the ACQUIRE, use a SADB_GETSPI to reserve 4943 * an SPI value and a larval SA, then SADB_UPDATE the larval SA, and ADD the 4944 * other direction's SA. 4945 */ 4946 4947 /* 4948 * Check the ACQUIRE lists. If there's an existing ACQUIRE record, 4949 * grab it, lock it, and return it. Otherwise return NULL. 4950 */ 4951 static ipsacq_t * 4952 sadb_checkacquire(iacqf_t *bucket, ipsec_action_t *ap, ipsec_policy_t *pp, 4953 uint32_t *src, uint32_t *dst, uint32_t *isrc, uint32_t *idst, 4954 uint64_t unique_id) 4955 { 4956 ipsacq_t *walker; 4957 sa_family_t fam; 4958 uint32_t blank_address[4] = {0, 0, 0, 0}; 4959 4960 if (isrc == NULL) { 4961 ASSERT(idst == NULL); 4962 isrc = idst = blank_address; 4963 } 4964 4965 /* 4966 * Scan list for duplicates. Check for UNIQUE, src/dest, policy. 4967 * 4968 * XXX May need search for duplicates based on other things too! 4969 */ 4970 for (walker = bucket->iacqf_ipsacq; walker != NULL; 4971 walker = walker->ipsacq_next) { 4972 mutex_enter(&walker->ipsacq_lock); 4973 fam = walker->ipsacq_addrfam; 4974 if (IPSA_ARE_ADDR_EQUAL(dst, walker->ipsacq_dstaddr, fam) && 4975 IPSA_ARE_ADDR_EQUAL(src, walker->ipsacq_srcaddr, fam) && 4976 ip_addr_match((uint8_t *)isrc, walker->ipsacq_innersrcpfx, 4977 (in6_addr_t *)walker->ipsacq_innersrc) && 4978 ip_addr_match((uint8_t *)idst, walker->ipsacq_innerdstpfx, 4979 (in6_addr_t *)walker->ipsacq_innerdst) && 4980 (ap == walker->ipsacq_act) && 4981 (pp == walker->ipsacq_policy) && 4982 /* XXX do deep compares of ap/pp? */ 4983 (unique_id == walker->ipsacq_unique_id)) 4984 break; /* everything matched */ 4985 mutex_exit(&walker->ipsacq_lock); 4986 } 4987 4988 return (walker); 4989 } 4990 4991 /* 4992 * For this mblk, insert a new acquire record. Assume bucket contains addrs 4993 * of all of the same length. Give up (and drop) if memory 4994 * cannot be allocated for a new one; otherwise, invoke callback to 4995 * send the acquire up.. 4996 * 4997 * In cases where we need both AH and ESP, add the SA to the ESP ACQUIRE 4998 * list. The ah_add_sa_finish() routines can look at the packet's ipsec_out_t 4999 * and handle this case specially. 5000 */ 5001 void 5002 sadb_acquire(mblk_t *mp, ipsec_out_t *io, boolean_t need_ah, boolean_t need_esp) 5003 { 5004 sadbp_t *spp; 5005 sadb_t *sp; 5006 ipsacq_t *newbie; 5007 iacqf_t *bucket; 5008 mblk_t *datamp = mp->b_cont; 5009 mblk_t *extended; 5010 ipha_t *ipha = (ipha_t *)datamp->b_rptr; 5011 ip6_t *ip6h = (ip6_t *)datamp->b_rptr; 5012 uint32_t *src, *dst, *isrc, *idst; 5013 ipsec_policy_t *pp = io->ipsec_out_policy; 5014 ipsec_action_t *ap = io->ipsec_out_act; 5015 sa_family_t af; 5016 int hashoffset; 5017 uint32_t seq; 5018 uint64_t unique_id = 0; 5019 ipsec_selector_t sel; 5020 boolean_t tunnel_mode = io->ipsec_out_tunnel; 5021 netstack_t *ns = io->ipsec_out_ns; 5022 ipsec_stack_t *ipss = ns->netstack_ipsec; 5023 5024 ASSERT((pp != NULL) || (ap != NULL)); 5025 5026 ASSERT(need_ah != NULL || need_esp != NULL); 5027 /* Assign sadb pointers */ 5028 if (need_esp) { /* ESP for AH+ESP */ 5029 ipsecesp_stack_t *espstack = ns->netstack_ipsecesp; 5030 5031 spp = &espstack->esp_sadb; 5032 } else { 5033 ipsecah_stack_t *ahstack = ns->netstack_ipsecah; 5034 5035 spp = &ahstack->ah_sadb; 5036 } 5037 sp = io->ipsec_out_v4 ? &spp->s_v4 : &spp->s_v6; 5038 5039 if (ap == NULL) 5040 ap = pp->ipsp_act; 5041 5042 ASSERT(ap != NULL); 5043 5044 if (ap->ipa_act.ipa_apply.ipp_use_unique || tunnel_mode) 5045 unique_id = SA_FORM_UNIQUE_ID(io); 5046 5047 /* 5048 * Set up an ACQUIRE record. 5049 * 5050 * Immediately, make sure the ACQUIRE sequence number doesn't slip 5051 * below the lowest point allowed in the kernel. (In other words, 5052 * make sure the high bit on the sequence number is set.) 5053 */ 5054 5055 seq = keysock_next_seq(ns) | IACQF_LOWEST_SEQ; 5056 5057 if (IPH_HDR_VERSION(ipha) == IP_VERSION) { 5058 src = (uint32_t *)&ipha->ipha_src; 5059 dst = (uint32_t *)&ipha->ipha_dst; 5060 af = AF_INET; 5061 hashoffset = OUTBOUND_HASH_V4(sp, ipha->ipha_dst); 5062 ASSERT(io->ipsec_out_v4 == B_TRUE); 5063 } else { 5064 ASSERT(IPH_HDR_VERSION(ipha) == IPV6_VERSION); 5065 src = (uint32_t *)&ip6h->ip6_src; 5066 dst = (uint32_t *)&ip6h->ip6_dst; 5067 af = AF_INET6; 5068 hashoffset = OUTBOUND_HASH_V6(sp, ip6h->ip6_dst); 5069 ASSERT(io->ipsec_out_v4 == B_FALSE); 5070 } 5071 5072 if (tunnel_mode) { 5073 if (pp == NULL) { 5074 /* 5075 * Tunnel mode with no policy pointer means this is a 5076 * reflected ICMP (like a ECHO REQUEST) that came in 5077 * with self-encapsulated protection. Until we better 5078 * support this, drop the packet. 5079 */ 5080 ip_drop_packet(mp, B_FALSE, NULL, NULL, 5081 DROPPER(ipss, ipds_spd_got_selfencap), 5082 &ipss->ipsec_spd_dropper); 5083 return; 5084 } 5085 /* Snag inner addresses. */ 5086 isrc = io->ipsec_out_insrc; 5087 idst = io->ipsec_out_indst; 5088 } else { 5089 isrc = idst = NULL; 5090 } 5091 5092 /* 5093 * Check buckets to see if there is an existing entry. If so, 5094 * grab it. sadb_checkacquire locks newbie if found. 5095 */ 5096 bucket = &(sp->sdb_acq[hashoffset]); 5097 mutex_enter(&bucket->iacqf_lock); 5098 newbie = sadb_checkacquire(bucket, ap, pp, src, dst, isrc, idst, 5099 unique_id); 5100 5101 if (newbie == NULL) { 5102 /* 5103 * Otherwise, allocate a new one. 5104 */ 5105 newbie = kmem_zalloc(sizeof (*newbie), KM_NOSLEEP); 5106 if (newbie == NULL) { 5107 mutex_exit(&bucket->iacqf_lock); 5108 ip_drop_packet(mp, B_FALSE, NULL, NULL, 5109 DROPPER(ipss, ipds_sadb_acquire_nomem), 5110 &ipss->ipsec_sadb_dropper); 5111 return; 5112 } 5113 newbie->ipsacq_policy = pp; 5114 if (pp != NULL) { 5115 IPPOL_REFHOLD(pp); 5116 } 5117 IPACT_REFHOLD(ap); 5118 newbie->ipsacq_act = ap; 5119 newbie->ipsacq_linklock = &bucket->iacqf_lock; 5120 newbie->ipsacq_next = bucket->iacqf_ipsacq; 5121 newbie->ipsacq_ptpn = &bucket->iacqf_ipsacq; 5122 if (newbie->ipsacq_next != NULL) 5123 newbie->ipsacq_next->ipsacq_ptpn = &newbie->ipsacq_next; 5124 bucket->iacqf_ipsacq = newbie; 5125 mutex_init(&newbie->ipsacq_lock, NULL, MUTEX_DEFAULT, NULL); 5126 mutex_enter(&newbie->ipsacq_lock); 5127 } 5128 5129 mutex_exit(&bucket->iacqf_lock); 5130 5131 /* 5132 * This assert looks silly for now, but we may need to enter newbie's 5133 * mutex during a search. 5134 */ 5135 ASSERT(MUTEX_HELD(&newbie->ipsacq_lock)); 5136 5137 mp->b_next = NULL; 5138 /* Queue up packet. Use b_next. */ 5139 if (newbie->ipsacq_numpackets == 0) { 5140 /* First one. */ 5141 newbie->ipsacq_mp = mp; 5142 newbie->ipsacq_numpackets = 1; 5143 newbie->ipsacq_expire = gethrestime_sec(); 5144 /* 5145 * Extended ACQUIRE with both AH+ESP will use ESP's timeout 5146 * value. 5147 */ 5148 newbie->ipsacq_expire += *spp->s_acquire_timeout; 5149 newbie->ipsacq_seq = seq; 5150 newbie->ipsacq_addrfam = af; 5151 5152 newbie->ipsacq_srcport = io->ipsec_out_src_port; 5153 newbie->ipsacq_dstport = io->ipsec_out_dst_port; 5154 newbie->ipsacq_icmp_type = io->ipsec_out_icmp_type; 5155 newbie->ipsacq_icmp_code = io->ipsec_out_icmp_code; 5156 if (tunnel_mode) { 5157 newbie->ipsacq_inneraddrfam = io->ipsec_out_inaf; 5158 newbie->ipsacq_proto = io->ipsec_out_inaf == AF_INET6 ? 5159 IPPROTO_IPV6 : IPPROTO_ENCAP; 5160 newbie->ipsacq_innersrcpfx = io->ipsec_out_insrcpfx; 5161 newbie->ipsacq_innerdstpfx = io->ipsec_out_indstpfx; 5162 IPSA_COPY_ADDR(newbie->ipsacq_innersrc, 5163 io->ipsec_out_insrc, io->ipsec_out_inaf); 5164 IPSA_COPY_ADDR(newbie->ipsacq_innerdst, 5165 io->ipsec_out_indst, io->ipsec_out_inaf); 5166 } else { 5167 newbie->ipsacq_proto = io->ipsec_out_proto; 5168 } 5169 newbie->ipsacq_unique_id = unique_id; 5170 } else { 5171 /* Scan to the end of the list & insert. */ 5172 mblk_t *lastone = newbie->ipsacq_mp; 5173 5174 while (lastone->b_next != NULL) 5175 lastone = lastone->b_next; 5176 lastone->b_next = mp; 5177 if (newbie->ipsacq_numpackets++ == ipsacq_maxpackets) { 5178 newbie->ipsacq_numpackets = ipsacq_maxpackets; 5179 lastone = newbie->ipsacq_mp; 5180 newbie->ipsacq_mp = lastone->b_next; 5181 lastone->b_next = NULL; 5182 ip_drop_packet(lastone, B_FALSE, NULL, NULL, 5183 DROPPER(ipss, ipds_sadb_acquire_toofull), 5184 &ipss->ipsec_sadb_dropper); 5185 } else { 5186 IP_ACQUIRE_STAT(ipss, qhiwater, 5187 newbie->ipsacq_numpackets); 5188 } 5189 } 5190 5191 /* 5192 * Reset addresses. Set them to the most recently added mblk chain, 5193 * so that the address pointers in the acquire record will point 5194 * at an mblk still attached to the acquire list. 5195 */ 5196 5197 newbie->ipsacq_srcaddr = src; 5198 newbie->ipsacq_dstaddr = dst; 5199 5200 /* 5201 * If the acquire record has more than one queued packet, we've 5202 * already sent an ACQUIRE, and don't need to repeat ourself. 5203 */ 5204 if (newbie->ipsacq_seq != seq || newbie->ipsacq_numpackets > 1) { 5205 /* I have an acquire outstanding already! */ 5206 mutex_exit(&newbie->ipsacq_lock); 5207 return; 5208 } 5209 5210 if (keysock_extended_reg(ns)) { 5211 /* 5212 * Construct an extended ACQUIRE. There are logging 5213 * opportunities here in failure cases. 5214 */ 5215 5216 (void) memset(&sel, 0, sizeof (sel)); 5217 sel.ips_isv4 = io->ipsec_out_v4; 5218 if (tunnel_mode) { 5219 sel.ips_protocol = (io->ipsec_out_inaf == AF_INET) ? 5220 IPPROTO_ENCAP : IPPROTO_IPV6; 5221 } else { 5222 sel.ips_protocol = io->ipsec_out_proto; 5223 sel.ips_local_port = io->ipsec_out_src_port; 5224 sel.ips_remote_port = io->ipsec_out_dst_port; 5225 } 5226 sel.ips_icmp_type = io->ipsec_out_icmp_type; 5227 sel.ips_icmp_code = io->ipsec_out_icmp_code; 5228 sel.ips_is_icmp_inv_acq = 0; 5229 if (af == AF_INET) { 5230 sel.ips_local_addr_v4 = ipha->ipha_src; 5231 sel.ips_remote_addr_v4 = ipha->ipha_dst; 5232 } else { 5233 sel.ips_local_addr_v6 = ip6h->ip6_src; 5234 sel.ips_remote_addr_v6 = ip6h->ip6_dst; 5235 } 5236 5237 extended = sadb_keysock_out(0); 5238 if (extended != NULL) { 5239 extended->b_cont = sadb_extended_acquire(&sel, pp, ap, 5240 tunnel_mode, seq, 0, ns); 5241 if (extended->b_cont == NULL) { 5242 freeb(extended); 5243 extended = NULL; 5244 } 5245 } 5246 } else 5247 extended = NULL; 5248 5249 /* 5250 * Send an ACQUIRE message (and possible an extended ACQUIRE) based on 5251 * this new record. The send-acquire callback assumes that acqrec is 5252 * already locked. 5253 */ 5254 (*spp->s_acqfn)(newbie, extended, ns); 5255 } 5256 5257 /* 5258 * Unlink and free an acquire record. 5259 */ 5260 void 5261 sadb_destroy_acquire(ipsacq_t *acqrec, netstack_t *ns) 5262 { 5263 mblk_t *mp; 5264 ipsec_stack_t *ipss = ns->netstack_ipsec; 5265 5266 ASSERT(MUTEX_HELD(acqrec->ipsacq_linklock)); 5267 5268 if (acqrec->ipsacq_policy != NULL) { 5269 IPPOL_REFRELE(acqrec->ipsacq_policy, ns); 5270 } 5271 if (acqrec->ipsacq_act != NULL) { 5272 IPACT_REFRELE(acqrec->ipsacq_act); 5273 } 5274 5275 /* Unlink */ 5276 *(acqrec->ipsacq_ptpn) = acqrec->ipsacq_next; 5277 if (acqrec->ipsacq_next != NULL) 5278 acqrec->ipsacq_next->ipsacq_ptpn = acqrec->ipsacq_ptpn; 5279 5280 /* 5281 * Free hanging mp's. 5282 * 5283 * XXX Instead of freemsg(), perhaps use IPSEC_REQ_FAILED. 5284 */ 5285 5286 mutex_enter(&acqrec->ipsacq_lock); 5287 while (acqrec->ipsacq_mp != NULL) { 5288 mp = acqrec->ipsacq_mp; 5289 acqrec->ipsacq_mp = mp->b_next; 5290 mp->b_next = NULL; 5291 ip_drop_packet(mp, B_FALSE, NULL, NULL, 5292 DROPPER(ipss, ipds_sadb_acquire_timeout), 5293 &ipss->ipsec_sadb_dropper); 5294 } 5295 mutex_exit(&acqrec->ipsacq_lock); 5296 5297 /* Free */ 5298 mutex_destroy(&acqrec->ipsacq_lock); 5299 kmem_free(acqrec, sizeof (*acqrec)); 5300 } 5301 5302 /* 5303 * Destroy an acquire list fanout. 5304 */ 5305 static void 5306 sadb_destroy_acqlist(iacqf_t **listp, uint_t numentries, boolean_t forever, 5307 netstack_t *ns) 5308 { 5309 int i; 5310 iacqf_t *list = *listp; 5311 5312 if (list == NULL) 5313 return; 5314 5315 for (i = 0; i < numentries; i++) { 5316 mutex_enter(&(list[i].iacqf_lock)); 5317 while (list[i].iacqf_ipsacq != NULL) 5318 sadb_destroy_acquire(list[i].iacqf_ipsacq, ns); 5319 mutex_exit(&(list[i].iacqf_lock)); 5320 if (forever) 5321 mutex_destroy(&(list[i].iacqf_lock)); 5322 } 5323 5324 if (forever) { 5325 *listp = NULL; 5326 kmem_free(list, numentries * sizeof (*list)); 5327 } 5328 } 5329 5330 /* 5331 * Create an algorithm descriptor for an extended ACQUIRE. Filter crypto 5332 * framework's view of reality vs. IPsec's. EF's wins, BTW. 5333 */ 5334 static uint8_t * 5335 sadb_new_algdesc(uint8_t *start, uint8_t *limit, 5336 sadb_x_ecomb_t *ecomb, uint8_t satype, uint8_t algtype, 5337 uint8_t alg, uint16_t minbits, uint16_t maxbits, ipsec_stack_t *ipss) 5338 { 5339 uint8_t *cur = start; 5340 ipsec_alginfo_t *algp; 5341 sadb_x_algdesc_t *algdesc = (sadb_x_algdesc_t *)cur; 5342 5343 cur += sizeof (*algdesc); 5344 if (cur >= limit) 5345 return (NULL); 5346 5347 ecomb->sadb_x_ecomb_numalgs++; 5348 5349 /* 5350 * Normalize vs. crypto framework's limits. This way, you can specify 5351 * a stronger policy, and when the framework loads a stronger version, 5352 * you can just keep plowing w/o rewhacking your SPD. 5353 */ 5354 mutex_enter(&ipss->ipsec_alg_lock); 5355 algp = ipss->ipsec_alglists[(algtype == SADB_X_ALGTYPE_AUTH) ? 5356 IPSEC_ALG_AUTH : IPSEC_ALG_ENCR][alg]; 5357 if (algp == NULL) { 5358 mutex_exit(&ipss->ipsec_alg_lock); 5359 return (NULL); /* Algorithm doesn't exist. Fail gracefully. */ 5360 } 5361 if (minbits < algp->alg_ef_minbits) 5362 minbits = algp->alg_ef_minbits; 5363 if (maxbits > algp->alg_ef_maxbits) 5364 maxbits = algp->alg_ef_maxbits; 5365 mutex_exit(&ipss->ipsec_alg_lock); 5366 5367 algdesc->sadb_x_algdesc_satype = satype; 5368 algdesc->sadb_x_algdesc_algtype = algtype; 5369 algdesc->sadb_x_algdesc_alg = alg; 5370 algdesc->sadb_x_algdesc_minbits = minbits; 5371 algdesc->sadb_x_algdesc_maxbits = maxbits; 5372 algdesc->sadb_x_algdesc_reserved = 0; 5373 return (cur); 5374 } 5375 5376 /* 5377 * Convert the given ipsec_action_t into an ecomb starting at *ecomb 5378 * which must fit before *limit 5379 * 5380 * return NULL if we ran out of room or a pointer to the end of the ecomb. 5381 */ 5382 static uint8_t * 5383 sadb_action_to_ecomb(uint8_t *start, uint8_t *limit, ipsec_action_t *act, 5384 netstack_t *ns) 5385 { 5386 uint8_t *cur = start; 5387 sadb_x_ecomb_t *ecomb = (sadb_x_ecomb_t *)cur; 5388 ipsec_prot_t *ipp; 5389 ipsec_stack_t *ipss = ns->netstack_ipsec; 5390 5391 cur += sizeof (*ecomb); 5392 if (cur >= limit) 5393 return (NULL); 5394 5395 ASSERT(act->ipa_act.ipa_type == IPSEC_ACT_APPLY); 5396 5397 ipp = &act->ipa_act.ipa_apply; 5398 5399 ecomb->sadb_x_ecomb_numalgs = 0; 5400 ecomb->sadb_x_ecomb_reserved = 0; 5401 ecomb->sadb_x_ecomb_reserved2 = 0; 5402 /* 5403 * No limits on allocations, since we really don't support that 5404 * concept currently. 5405 */ 5406 ecomb->sadb_x_ecomb_soft_allocations = 0; 5407 ecomb->sadb_x_ecomb_hard_allocations = 0; 5408 5409 /* 5410 * XXX TBD: Policy or global parameters will eventually be 5411 * able to fill in some of these. 5412 */ 5413 ecomb->sadb_x_ecomb_flags = 0; 5414 ecomb->sadb_x_ecomb_soft_bytes = 0; 5415 ecomb->sadb_x_ecomb_hard_bytes = 0; 5416 ecomb->sadb_x_ecomb_soft_addtime = 0; 5417 ecomb->sadb_x_ecomb_hard_addtime = 0; 5418 ecomb->sadb_x_ecomb_soft_usetime = 0; 5419 ecomb->sadb_x_ecomb_hard_usetime = 0; 5420 5421 if (ipp->ipp_use_ah) { 5422 cur = sadb_new_algdesc(cur, limit, ecomb, 5423 SADB_SATYPE_AH, SADB_X_ALGTYPE_AUTH, ipp->ipp_auth_alg, 5424 ipp->ipp_ah_minbits, ipp->ipp_ah_maxbits, ipss); 5425 if (cur == NULL) 5426 return (NULL); 5427 ipsecah_fill_defs(ecomb, ns); 5428 } 5429 5430 if (ipp->ipp_use_esp) { 5431 if (ipp->ipp_use_espa) { 5432 cur = sadb_new_algdesc(cur, limit, ecomb, 5433 SADB_SATYPE_ESP, SADB_X_ALGTYPE_AUTH, 5434 ipp->ipp_esp_auth_alg, 5435 ipp->ipp_espa_minbits, 5436 ipp->ipp_espa_maxbits, ipss); 5437 if (cur == NULL) 5438 return (NULL); 5439 } 5440 5441 cur = sadb_new_algdesc(cur, limit, ecomb, 5442 SADB_SATYPE_ESP, SADB_X_ALGTYPE_CRYPT, 5443 ipp->ipp_encr_alg, 5444 ipp->ipp_espe_minbits, 5445 ipp->ipp_espe_maxbits, ipss); 5446 if (cur == NULL) 5447 return (NULL); 5448 /* Fill in lifetimes if and only if AH didn't already... */ 5449 if (!ipp->ipp_use_ah) 5450 ipsecesp_fill_defs(ecomb, ns); 5451 } 5452 5453 return (cur); 5454 } 5455 5456 /* 5457 * Construct an extended ACQUIRE message based on a selector and the resulting 5458 * IPsec action. 5459 * 5460 * NOTE: This is used by both inverse ACQUIRE and actual ACQUIRE 5461 * generation. As a consequence, expect this function to evolve 5462 * rapidly. 5463 */ 5464 static mblk_t * 5465 sadb_extended_acquire(ipsec_selector_t *sel, ipsec_policy_t *pol, 5466 ipsec_action_t *act, boolean_t tunnel_mode, uint32_t seq, uint32_t pid, 5467 netstack_t *ns) 5468 { 5469 mblk_t *mp; 5470 sadb_msg_t *samsg; 5471 uint8_t *start, *cur, *end; 5472 uint32_t *saddrptr, *daddrptr; 5473 sa_family_t af; 5474 sadb_prop_t *eprop; 5475 ipsec_action_t *ap, *an; 5476 ipsec_selkey_t *ipsl; 5477 uint8_t proto, pfxlen; 5478 uint16_t lport, rport; 5479 uint32_t kmp, kmc; 5480 5481 /* 5482 * Find the action we want sooner rather than later.. 5483 */ 5484 an = NULL; 5485 if (pol == NULL) { 5486 ap = act; 5487 } else { 5488 ap = pol->ipsp_act; 5489 5490 if (ap != NULL) 5491 an = ap->ipa_next; 5492 } 5493 5494 /* 5495 * Just take a swag for the allocation for now. We can always 5496 * alter it later. 5497 */ 5498 #define SADB_EXTENDED_ACQUIRE_SIZE 4096 5499 mp = allocb(SADB_EXTENDED_ACQUIRE_SIZE, BPRI_HI); 5500 if (mp == NULL) 5501 return (NULL); 5502 5503 start = mp->b_rptr; 5504 end = start + SADB_EXTENDED_ACQUIRE_SIZE; 5505 5506 cur = start; 5507 5508 samsg = (sadb_msg_t *)cur; 5509 cur += sizeof (*samsg); 5510 5511 samsg->sadb_msg_version = PF_KEY_V2; 5512 samsg->sadb_msg_type = SADB_ACQUIRE; 5513 samsg->sadb_msg_errno = 0; 5514 samsg->sadb_msg_reserved = 0; 5515 samsg->sadb_msg_satype = 0; 5516 samsg->sadb_msg_seq = seq; 5517 samsg->sadb_msg_pid = pid; 5518 5519 if (tunnel_mode) { 5520 /* 5521 * Form inner address extensions based NOT on the inner 5522 * selectors (i.e. the packet data), but on the policy's 5523 * selector key (i.e. the policy's selector information). 5524 * 5525 * NOTE: The position of IPv4 and IPv6 addresses is the 5526 * same in ipsec_selkey_t (unless the compiler does very 5527 * strange things with unions, consult your local C language 5528 * lawyer for details). 5529 */ 5530 ASSERT(pol != NULL); 5531 5532 ipsl = &(pol->ipsp_sel->ipsl_key); 5533 if (ipsl->ipsl_valid & IPSL_IPV4) { 5534 af = AF_INET; 5535 ASSERT(sel->ips_protocol == IPPROTO_ENCAP); 5536 ASSERT(!(ipsl->ipsl_valid & IPSL_IPV6)); 5537 } else { 5538 af = AF_INET6; 5539 ASSERT(sel->ips_protocol == IPPROTO_IPV6); 5540 ASSERT(ipsl->ipsl_valid & IPSL_IPV6); 5541 } 5542 5543 if (ipsl->ipsl_valid & IPSL_LOCAL_ADDR) { 5544 saddrptr = (uint32_t *)(&ipsl->ipsl_local); 5545 pfxlen = ipsl->ipsl_local_pfxlen; 5546 } else { 5547 saddrptr = (uint32_t *)(&ipv6_all_zeros); 5548 pfxlen = 0; 5549 } 5550 /* XXX What about ICMP type/code? */ 5551 lport = (ipsl->ipsl_valid & IPSL_LOCAL_PORT) ? 5552 ipsl->ipsl_lport : 0; 5553 proto = (ipsl->ipsl_valid & IPSL_PROTOCOL) ? 5554 ipsl->ipsl_proto : 0; 5555 5556 cur = sadb_make_addr_ext(cur, end, SADB_X_EXT_ADDRESS_INNER_SRC, 5557 af, saddrptr, lport, proto, pfxlen); 5558 if (cur == NULL) { 5559 freeb(mp); 5560 return (NULL); 5561 } 5562 5563 if (ipsl->ipsl_valid & IPSL_REMOTE_ADDR) { 5564 daddrptr = (uint32_t *)(&ipsl->ipsl_remote); 5565 pfxlen = ipsl->ipsl_remote_pfxlen; 5566 } else { 5567 daddrptr = (uint32_t *)(&ipv6_all_zeros); 5568 pfxlen = 0; 5569 } 5570 /* XXX What about ICMP type/code? */ 5571 rport = (ipsl->ipsl_valid & IPSL_REMOTE_PORT) ? 5572 ipsl->ipsl_rport : 0; 5573 5574 cur = sadb_make_addr_ext(cur, end, SADB_X_EXT_ADDRESS_INNER_DST, 5575 af, daddrptr, rport, proto, pfxlen); 5576 if (cur == NULL) { 5577 freeb(mp); 5578 return (NULL); 5579 } 5580 /* 5581 * TODO - if we go to 3408's dream of transport mode IP-in-IP 5582 * _with_ inner-packet address selectors, we'll need to further 5583 * distinguish tunnel mode here. For now, having inner 5584 * addresses and/or ports is sufficient. 5585 * 5586 * Meanwhile, whack proto/ports to reflect IP-in-IP for the 5587 * outer addresses. 5588 */ 5589 proto = sel->ips_protocol; /* Either _ENCAP or _IPV6 */ 5590 lport = rport = 0; 5591 } else if ((ap != NULL) && (!ap->ipa_want_unique)) { 5592 proto = 0; 5593 lport = 0; 5594 rport = 0; 5595 if (pol != NULL) { 5596 ipsl = &(pol->ipsp_sel->ipsl_key); 5597 if (ipsl->ipsl_valid & IPSL_PROTOCOL) 5598 proto = ipsl->ipsl_proto; 5599 if (ipsl->ipsl_valid & IPSL_REMOTE_PORT) 5600 rport = ipsl->ipsl_rport; 5601 if (ipsl->ipsl_valid & IPSL_LOCAL_PORT) 5602 lport = ipsl->ipsl_lport; 5603 } 5604 } else { 5605 proto = sel->ips_protocol; 5606 lport = sel->ips_local_port; 5607 rport = sel->ips_remote_port; 5608 } 5609 5610 af = sel->ips_isv4 ? AF_INET : AF_INET6; 5611 5612 /* 5613 * NOTE: The position of IPv4 and IPv6 addresses is the same in 5614 * ipsec_selector_t. 5615 */ 5616 cur = sadb_make_addr_ext(cur, end, SADB_EXT_ADDRESS_SRC, af, 5617 (uint32_t *)(&sel->ips_local_addr_v6), lport, proto, 0); 5618 5619 if (cur == NULL) { 5620 freeb(mp); 5621 return (NULL); 5622 } 5623 5624 cur = sadb_make_addr_ext(cur, end, SADB_EXT_ADDRESS_DST, af, 5625 (uint32_t *)(&sel->ips_remote_addr_v6), rport, proto, 0); 5626 5627 if (cur == NULL) { 5628 freeb(mp); 5629 return (NULL); 5630 } 5631 5632 /* 5633 * This section will change a lot as policy evolves. 5634 * For now, it'll be relatively simple. 5635 */ 5636 eprop = (sadb_prop_t *)cur; 5637 cur += sizeof (*eprop); 5638 if (cur > end) { 5639 /* no space left */ 5640 freeb(mp); 5641 return (NULL); 5642 } 5643 5644 eprop->sadb_prop_exttype = SADB_X_EXT_EPROP; 5645 eprop->sadb_x_prop_ereserved = 0; 5646 eprop->sadb_x_prop_numecombs = 0; 5647 eprop->sadb_prop_replay = 32; /* default */ 5648 5649 kmc = kmp = 0; 5650 5651 for (; ap != NULL; ap = an) { 5652 an = (pol != NULL) ? ap->ipa_next : NULL; 5653 5654 /* 5655 * Skip non-IPsec policies 5656 */ 5657 if (ap->ipa_act.ipa_type != IPSEC_ACT_APPLY) 5658 continue; 5659 5660 if (ap->ipa_act.ipa_apply.ipp_km_proto) 5661 kmp = ap->ipa_act.ipa_apply.ipp_km_proto; 5662 if (ap->ipa_act.ipa_apply.ipp_km_cookie) 5663 kmc = ap->ipa_act.ipa_apply.ipp_km_cookie; 5664 if (ap->ipa_act.ipa_apply.ipp_replay_depth) { 5665 eprop->sadb_prop_replay = 5666 ap->ipa_act.ipa_apply.ipp_replay_depth; 5667 } 5668 5669 cur = sadb_action_to_ecomb(cur, end, ap, ns); 5670 if (cur == NULL) { /* no space */ 5671 freeb(mp); 5672 return (NULL); 5673 } 5674 eprop->sadb_x_prop_numecombs++; 5675 } 5676 5677 if (eprop->sadb_x_prop_numecombs == 0) { 5678 /* 5679 * This will happen if we fail to find a policy 5680 * allowing for IPsec processing. 5681 * Construct an error message. 5682 */ 5683 samsg->sadb_msg_len = SADB_8TO64(sizeof (*samsg)); 5684 samsg->sadb_msg_errno = ENOENT; 5685 samsg->sadb_x_msg_diagnostic = 0; 5686 return (mp); 5687 } 5688 5689 if ((kmp != 0) || (kmc != 0)) { 5690 cur = sadb_make_kmc_ext(cur, end, kmp, kmc); 5691 if (cur == NULL) { 5692 freeb(mp); 5693 return (NULL); 5694 } 5695 } 5696 5697 eprop->sadb_prop_len = SADB_8TO64(cur - (uint8_t *)eprop); 5698 samsg->sadb_msg_len = SADB_8TO64(cur - start); 5699 mp->b_wptr = cur; 5700 5701 return (mp); 5702 } 5703 5704 /* 5705 * Generic setup of an RFC 2367 ACQUIRE message. Caller sets satype. 5706 * 5707 * NOTE: This function acquires alg_lock as a side-effect if-and-only-if we 5708 * succeed (i.e. return non-NULL). Caller MUST release it. This is to 5709 * maximize code consolidation while preventing algorithm changes from messing 5710 * with the callers finishing touches on the ACQUIRE itself. 5711 */ 5712 mblk_t * 5713 sadb_setup_acquire(ipsacq_t *acqrec, uint8_t satype, ipsec_stack_t *ipss) 5714 { 5715 uint_t allocsize; 5716 mblk_t *pfkeymp, *msgmp; 5717 sa_family_t af; 5718 uint8_t *cur, *end; 5719 sadb_msg_t *samsg; 5720 uint16_t sport_typecode; 5721 uint16_t dport_typecode; 5722 uint8_t check_proto; 5723 boolean_t tunnel_mode = (acqrec->ipsacq_inneraddrfam != 0); 5724 5725 ASSERT(MUTEX_HELD(&acqrec->ipsacq_lock)); 5726 5727 pfkeymp = sadb_keysock_out(0); 5728 if (pfkeymp == NULL) 5729 return (NULL); 5730 5731 /* 5732 * First, allocate a basic ACQUIRE message 5733 */ 5734 allocsize = sizeof (sadb_msg_t) + sizeof (sadb_address_t) + 5735 sizeof (sadb_address_t) + sizeof (sadb_prop_t); 5736 5737 /* Make sure there's enough to cover both AF_INET and AF_INET6. */ 5738 allocsize += 2 * sizeof (struct sockaddr_in6); 5739 5740 mutex_enter(&ipss->ipsec_alg_lock); 5741 /* NOTE: The lock is now held through to this function's return. */ 5742 allocsize += ipss->ipsec_nalgs[IPSEC_ALG_AUTH] * 5743 ipss->ipsec_nalgs[IPSEC_ALG_ENCR] * sizeof (sadb_comb_t); 5744 5745 if (tunnel_mode) { 5746 /* Tunnel mode! */ 5747 allocsize += 2 * sizeof (sadb_address_t); 5748 /* Enough to cover both AF_INET and AF_INET6. */ 5749 allocsize += 2 * sizeof (struct sockaddr_in6); 5750 } 5751 5752 msgmp = allocb(allocsize, BPRI_HI); 5753 if (msgmp == NULL) { 5754 freeb(pfkeymp); 5755 mutex_exit(&ipss->ipsec_alg_lock); 5756 return (NULL); 5757 } 5758 5759 pfkeymp->b_cont = msgmp; 5760 cur = msgmp->b_rptr; 5761 end = cur + allocsize; 5762 samsg = (sadb_msg_t *)cur; 5763 cur += sizeof (sadb_msg_t); 5764 5765 af = acqrec->ipsacq_addrfam; 5766 switch (af) { 5767 case AF_INET: 5768 check_proto = IPPROTO_ICMP; 5769 break; 5770 case AF_INET6: 5771 check_proto = IPPROTO_ICMPV6; 5772 break; 5773 default: 5774 /* This should never happen unless we have kernel bugs. */ 5775 cmn_err(CE_WARN, 5776 "sadb_setup_acquire: corrupt ACQUIRE record.\n"); 5777 ASSERT(0); 5778 mutex_exit(&ipss->ipsec_alg_lock); 5779 return (NULL); 5780 } 5781 5782 samsg->sadb_msg_version = PF_KEY_V2; 5783 samsg->sadb_msg_type = SADB_ACQUIRE; 5784 samsg->sadb_msg_satype = satype; 5785 samsg->sadb_msg_errno = 0; 5786 samsg->sadb_msg_pid = 0; 5787 samsg->sadb_msg_reserved = 0; 5788 samsg->sadb_msg_seq = acqrec->ipsacq_seq; 5789 5790 ASSERT(MUTEX_HELD(&acqrec->ipsacq_lock)); 5791 5792 if ((acqrec->ipsacq_proto == check_proto) || tunnel_mode) { 5793 sport_typecode = dport_typecode = 0; 5794 } else { 5795 sport_typecode = acqrec->ipsacq_srcport; 5796 dport_typecode = acqrec->ipsacq_dstport; 5797 } 5798 5799 cur = sadb_make_addr_ext(cur, end, SADB_EXT_ADDRESS_SRC, af, 5800 acqrec->ipsacq_srcaddr, sport_typecode, acqrec->ipsacq_proto, 0); 5801 5802 cur = sadb_make_addr_ext(cur, end, SADB_EXT_ADDRESS_DST, af, 5803 acqrec->ipsacq_dstaddr, dport_typecode, acqrec->ipsacq_proto, 0); 5804 5805 if (tunnel_mode) { 5806 sport_typecode = acqrec->ipsacq_srcport; 5807 dport_typecode = acqrec->ipsacq_dstport; 5808 cur = sadb_make_addr_ext(cur, end, SADB_X_EXT_ADDRESS_INNER_SRC, 5809 acqrec->ipsacq_inneraddrfam, acqrec->ipsacq_innersrc, 5810 sport_typecode, acqrec->ipsacq_inner_proto, 5811 acqrec->ipsacq_innersrcpfx); 5812 cur = sadb_make_addr_ext(cur, end, SADB_X_EXT_ADDRESS_INNER_DST, 5813 acqrec->ipsacq_inneraddrfam, acqrec->ipsacq_innerdst, 5814 dport_typecode, acqrec->ipsacq_inner_proto, 5815 acqrec->ipsacq_innerdstpfx); 5816 } 5817 5818 /* XXX Insert identity information here. */ 5819 5820 /* XXXMLS Insert sensitivity information here. */ 5821 5822 if (cur != NULL) 5823 samsg->sadb_msg_len = SADB_8TO64(cur - msgmp->b_rptr); 5824 else 5825 mutex_exit(&ipss->ipsec_alg_lock); 5826 5827 return (pfkeymp); 5828 } 5829 5830 /* 5831 * Given an SADB_GETSPI message, find an appropriately ranged SA and 5832 * allocate an SA. If there are message improprieties, return (ipsa_t *)-1. 5833 * If there was a memory allocation error, return NULL. (Assume NULL != 5834 * (ipsa_t *)-1). 5835 * 5836 * master_spi is passed in host order. 5837 */ 5838 ipsa_t * 5839 sadb_getspi(keysock_in_t *ksi, uint32_t master_spi, int *diagnostic, 5840 netstack_t *ns, uint_t sa_type) 5841 { 5842 sadb_address_t *src = 5843 (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_SRC], 5844 *dst = (sadb_address_t *)ksi->ks_in_extv[SADB_EXT_ADDRESS_DST]; 5845 sadb_spirange_t *range = 5846 (sadb_spirange_t *)ksi->ks_in_extv[SADB_EXT_SPIRANGE]; 5847 struct sockaddr_in *ssa, *dsa; 5848 struct sockaddr_in6 *ssa6, *dsa6; 5849 uint32_t *srcaddr, *dstaddr; 5850 sa_family_t af; 5851 uint32_t add, min, max; 5852 uint8_t protocol = 5853 (sa_type == SADB_SATYPE_AH) ? IPPROTO_AH : IPPROTO_ESP; 5854 5855 if (src == NULL) { 5856 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_SRC; 5857 return ((ipsa_t *)-1); 5858 } 5859 if (dst == NULL) { 5860 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_DST; 5861 return ((ipsa_t *)-1); 5862 } 5863 if (range == NULL) { 5864 *diagnostic = SADB_X_DIAGNOSTIC_MISSING_RANGE; 5865 return ((ipsa_t *)-1); 5866 } 5867 5868 min = ntohl(range->sadb_spirange_min); 5869 max = ntohl(range->sadb_spirange_max); 5870 dsa = (struct sockaddr_in *)(dst + 1); 5871 dsa6 = (struct sockaddr_in6 *)dsa; 5872 5873 ssa = (struct sockaddr_in *)(src + 1); 5874 ssa6 = (struct sockaddr_in6 *)ssa; 5875 ASSERT(dsa->sin_family == ssa->sin_family); 5876 5877 srcaddr = ALL_ZEROES_PTR; 5878 af = dsa->sin_family; 5879 switch (af) { 5880 case AF_INET: 5881 if (src != NULL) 5882 srcaddr = (uint32_t *)(&ssa->sin_addr); 5883 dstaddr = (uint32_t *)(&dsa->sin_addr); 5884 break; 5885 case AF_INET6: 5886 if (src != NULL) 5887 srcaddr = (uint32_t *)(&ssa6->sin6_addr); 5888 dstaddr = (uint32_t *)(&dsa6->sin6_addr); 5889 break; 5890 default: 5891 *diagnostic = SADB_X_DIAGNOSTIC_BAD_DST_AF; 5892 return ((ipsa_t *)-1); 5893 } 5894 5895 if (master_spi < min || master_spi > max) { 5896 /* Return a random value in the range. */ 5897 if (cl_inet_getspi) { 5898 cl_inet_getspi(ns->netstack_stackid, protocol, 5899 (uint8_t *)&add, sizeof (add), NULL); 5900 } else { 5901 (void) random_get_pseudo_bytes((uint8_t *)&add, 5902 sizeof (add)); 5903 } 5904 master_spi = min + (add % (max - min + 1)); 5905 } 5906 5907 /* 5908 * Since master_spi is passed in host order, we need to htonl() it 5909 * for the purposes of creating a new SA. 5910 */ 5911 return (sadb_makelarvalassoc(htonl(master_spi), srcaddr, dstaddr, af, 5912 ns)); 5913 } 5914 5915 /* 5916 * 5917 * Locate an ACQUIRE and nuke it. If I have an samsg that's larger than the 5918 * base header, just ignore it. Otherwise, lock down the whole ACQUIRE list 5919 * and scan for the sequence number in question. I may wish to accept an 5920 * address pair with it, for easier searching. 5921 * 5922 * Caller frees the message, so we don't have to here. 5923 * 5924 * NOTE: The ip_q parameter may be used in the future for ACQUIRE 5925 * failures. 5926 */ 5927 /* ARGSUSED */ 5928 void 5929 sadb_in_acquire(sadb_msg_t *samsg, sadbp_t *sp, queue_t *ip_q, netstack_t *ns) 5930 { 5931 int i; 5932 ipsacq_t *acqrec; 5933 iacqf_t *bucket; 5934 5935 /* 5936 * I only accept the base header for this! 5937 * Though to be honest, requiring the dst address would help 5938 * immensely. 5939 * 5940 * XXX There are already cases where I can get the dst address. 5941 */ 5942 if (samsg->sadb_msg_len > SADB_8TO64(sizeof (*samsg))) 5943 return; 5944 5945 /* 5946 * Using the samsg->sadb_msg_seq, find the ACQUIRE record, delete it, 5947 * (and in the future send a message to IP with the appropriate error 5948 * number). 5949 * 5950 * Q: Do I want to reject if pid != 0? 5951 */ 5952 5953 for (i = 0; i < sp->s_v4.sdb_hashsize; i++) { 5954 bucket = &sp->s_v4.sdb_acq[i]; 5955 mutex_enter(&bucket->iacqf_lock); 5956 for (acqrec = bucket->iacqf_ipsacq; acqrec != NULL; 5957 acqrec = acqrec->ipsacq_next) { 5958 if (samsg->sadb_msg_seq == acqrec->ipsacq_seq) 5959 break; /* for acqrec... loop. */ 5960 } 5961 if (acqrec != NULL) 5962 break; /* for i = 0... loop. */ 5963 5964 mutex_exit(&bucket->iacqf_lock); 5965 } 5966 5967 if (acqrec == NULL) { 5968 for (i = 0; i < sp->s_v6.sdb_hashsize; i++) { 5969 bucket = &sp->s_v6.sdb_acq[i]; 5970 mutex_enter(&bucket->iacqf_lock); 5971 for (acqrec = bucket->iacqf_ipsacq; acqrec != NULL; 5972 acqrec = acqrec->ipsacq_next) { 5973 if (samsg->sadb_msg_seq == acqrec->ipsacq_seq) 5974 break; /* for acqrec... loop. */ 5975 } 5976 if (acqrec != NULL) 5977 break; /* for i = 0... loop. */ 5978 5979 mutex_exit(&bucket->iacqf_lock); 5980 } 5981 } 5982 5983 5984 if (acqrec == NULL) 5985 return; 5986 5987 /* 5988 * What do I do with the errno and IP? I may need mp's services a 5989 * little more. See sadb_destroy_acquire() for future directions 5990 * beyond free the mblk chain on the acquire record. 5991 */ 5992 5993 ASSERT(&bucket->iacqf_lock == acqrec->ipsacq_linklock); 5994 sadb_destroy_acquire(acqrec, ns); 5995 /* Have to exit mutex here, because of breaking out of for loop. */ 5996 mutex_exit(&bucket->iacqf_lock); 5997 } 5998 5999 /* 6000 * The following functions work with the replay windows of an SA. They assume 6001 * the ipsa->ipsa_replay_arr is an array of uint64_t, and that the bit vector 6002 * represents the highest sequence number packet received, and back 6003 * (ipsa->ipsa_replay_wsize) packets. 6004 */ 6005 6006 /* 6007 * Is the replay bit set? 6008 */ 6009 static boolean_t 6010 ipsa_is_replay_set(ipsa_t *ipsa, uint32_t offset) 6011 { 6012 uint64_t bit = (uint64_t)1 << (uint64_t)(offset & 63); 6013 6014 return ((bit & ipsa->ipsa_replay_arr[offset >> 6]) ? B_TRUE : B_FALSE); 6015 } 6016 6017 /* 6018 * Shift the bits of the replay window over. 6019 */ 6020 static void 6021 ipsa_shift_replay(ipsa_t *ipsa, uint32_t shift) 6022 { 6023 int i; 6024 int jump = ((shift - 1) >> 6) + 1; 6025 6026 if (shift == 0) 6027 return; 6028 6029 for (i = (ipsa->ipsa_replay_wsize - 1) >> 6; i >= 0; i--) { 6030 if (i + jump <= (ipsa->ipsa_replay_wsize - 1) >> 6) { 6031 ipsa->ipsa_replay_arr[i + jump] |= 6032 ipsa->ipsa_replay_arr[i] >> (64 - (shift & 63)); 6033 } 6034 ipsa->ipsa_replay_arr[i] <<= shift; 6035 } 6036 } 6037 6038 /* 6039 * Set a bit in the bit vector. 6040 */ 6041 static void 6042 ipsa_set_replay(ipsa_t *ipsa, uint32_t offset) 6043 { 6044 uint64_t bit = (uint64_t)1 << (uint64_t)(offset & 63); 6045 6046 ipsa->ipsa_replay_arr[offset >> 6] |= bit; 6047 } 6048 6049 #define SADB_MAX_REPLAY_VALUE 0xffffffff 6050 6051 /* 6052 * Assume caller has NOT done ntohl() already on seq. Check to see 6053 * if replay sequence number "seq" has been seen already. 6054 */ 6055 boolean_t 6056 sadb_replay_check(ipsa_t *ipsa, uint32_t seq) 6057 { 6058 boolean_t rc; 6059 uint32_t diff; 6060 6061 if (ipsa->ipsa_replay_wsize == 0) 6062 return (B_TRUE); 6063 6064 /* 6065 * NOTE: I've already checked for 0 on the wire in sadb_replay_peek(). 6066 */ 6067 6068 /* Convert sequence number into host order before holding the mutex. */ 6069 seq = ntohl(seq); 6070 6071 mutex_enter(&ipsa->ipsa_lock); 6072 6073 /* Initialize inbound SA's ipsa_replay field to last one received. */ 6074 if (ipsa->ipsa_replay == 0) 6075 ipsa->ipsa_replay = 1; 6076 6077 if (seq > ipsa->ipsa_replay) { 6078 /* 6079 * I have received a new "highest value received". Shift 6080 * the replay window over. 6081 */ 6082 diff = seq - ipsa->ipsa_replay; 6083 if (diff < ipsa->ipsa_replay_wsize) { 6084 /* In replay window, shift bits over. */ 6085 ipsa_shift_replay(ipsa, diff); 6086 } else { 6087 /* WAY FAR AHEAD, clear bits and start again. */ 6088 bzero(ipsa->ipsa_replay_arr, 6089 sizeof (ipsa->ipsa_replay_arr)); 6090 } 6091 ipsa_set_replay(ipsa, 0); 6092 ipsa->ipsa_replay = seq; 6093 rc = B_TRUE; 6094 goto done; 6095 } 6096 diff = ipsa->ipsa_replay - seq; 6097 if (diff >= ipsa->ipsa_replay_wsize || ipsa_is_replay_set(ipsa, diff)) { 6098 rc = B_FALSE; 6099 goto done; 6100 } 6101 /* Set this packet as seen. */ 6102 ipsa_set_replay(ipsa, diff); 6103 6104 rc = B_TRUE; 6105 done: 6106 mutex_exit(&ipsa->ipsa_lock); 6107 return (rc); 6108 } 6109 6110 /* 6111 * "Peek" and see if we should even bother going through the effort of 6112 * running an authentication check on the sequence number passed in. 6113 * this takes into account packets that are below the replay window, 6114 * and collisions with already replayed packets. Return B_TRUE if it 6115 * is okay to proceed, B_FALSE if this packet should be dropped immediately. 6116 * Assume same byte-ordering as sadb_replay_check. 6117 */ 6118 boolean_t 6119 sadb_replay_peek(ipsa_t *ipsa, uint32_t seq) 6120 { 6121 boolean_t rc = B_FALSE; 6122 uint32_t diff; 6123 6124 if (ipsa->ipsa_replay_wsize == 0) 6125 return (B_TRUE); 6126 6127 /* 6128 * 0 is 0, regardless of byte order... :) 6129 * 6130 * If I get 0 on the wire (and there is a replay window) then the 6131 * sender most likely wrapped. This ipsa may need to be marked or 6132 * something. 6133 */ 6134 if (seq == 0) 6135 return (B_FALSE); 6136 6137 seq = ntohl(seq); 6138 mutex_enter(&ipsa->ipsa_lock); 6139 if (seq < ipsa->ipsa_replay - ipsa->ipsa_replay_wsize && 6140 ipsa->ipsa_replay >= ipsa->ipsa_replay_wsize) 6141 goto done; 6142 6143 /* 6144 * If I've hit 0xffffffff, then quite honestly, I don't need to 6145 * bother with formalities. I'm not accepting any more packets 6146 * on this SA. 6147 */ 6148 if (ipsa->ipsa_replay == SADB_MAX_REPLAY_VALUE) { 6149 /* 6150 * Since we're already holding the lock, update the 6151 * expire time ala. sadb_replay_delete() and return. 6152 */ 6153 ipsa->ipsa_hardexpiretime = (time_t)1; 6154 goto done; 6155 } 6156 6157 if (seq <= ipsa->ipsa_replay) { 6158 /* 6159 * This seq is in the replay window. I'm not below it, 6160 * because I already checked for that above! 6161 */ 6162 diff = ipsa->ipsa_replay - seq; 6163 if (ipsa_is_replay_set(ipsa, diff)) 6164 goto done; 6165 } 6166 /* Else return B_TRUE, I'm going to advance the window. */ 6167 6168 rc = B_TRUE; 6169 done: 6170 mutex_exit(&ipsa->ipsa_lock); 6171 return (rc); 6172 } 6173 6174 /* 6175 * Delete a single SA. 6176 * 6177 * For now, use the quick-and-dirty trick of making the association's 6178 * hard-expire lifetime (time_t)1, ensuring deletion by the *_ager(). 6179 */ 6180 void 6181 sadb_replay_delete(ipsa_t *assoc) 6182 { 6183 mutex_enter(&assoc->ipsa_lock); 6184 assoc->ipsa_hardexpiretime = (time_t)1; 6185 mutex_exit(&assoc->ipsa_lock); 6186 } 6187 6188 /* 6189 * Given a queue that presumably points to IP, send a T_BIND_REQ for _proto_ 6190 * down. The caller will handle the T_BIND_ACK locally. 6191 */ 6192 boolean_t 6193 sadb_t_bind_req(queue_t *q, int proto) 6194 { 6195 struct T_bind_req *tbr; 6196 mblk_t *mp; 6197 6198 mp = allocb_cred(sizeof (struct T_bind_req) + 1, kcred, NOPID); 6199 if (mp == NULL) { 6200 /* cmn_err(CE_WARN, */ 6201 /* "sadb_t_bind_req(%d): couldn't allocate mblk\n", proto); */ 6202 return (B_FALSE); 6203 } 6204 mp->b_datap->db_type = M_PCPROTO; 6205 tbr = (struct T_bind_req *)mp->b_rptr; 6206 mp->b_wptr += sizeof (struct T_bind_req); 6207 tbr->PRIM_type = T_BIND_REQ; 6208 tbr->ADDR_length = 0; 6209 tbr->ADDR_offset = 0; 6210 tbr->CONIND_number = 0; 6211 *mp->b_wptr = (uint8_t)proto; 6212 mp->b_wptr++; 6213 6214 putnext(q, mp); 6215 return (B_TRUE); 6216 } 6217 6218 /* 6219 * Special front-end to ipsec_rl_strlog() dealing with SA failure. 6220 * this is designed to take only a format string with "* %x * %s *", so 6221 * that "spi" is printed first, then "addr" is converted using inet_pton(). 6222 * 6223 * This is abstracted out to save the stack space for only when inet_pton() 6224 * is called. Make sure "spi" is in network order; it usually is when this 6225 * would get called. 6226 */ 6227 void 6228 ipsec_assocfailure(short mid, short sid, char level, ushort_t sl, char *fmt, 6229 uint32_t spi, void *addr, int af, netstack_t *ns) 6230 { 6231 char buf[INET6_ADDRSTRLEN]; 6232 6233 ASSERT(af == AF_INET6 || af == AF_INET); 6234 6235 ipsec_rl_strlog(ns, mid, sid, level, sl, fmt, ntohl(spi), 6236 inet_ntop(af, addr, buf, sizeof (buf))); 6237 } 6238 6239 /* 6240 * Fills in a reference to the policy, if any, from the conn, in *ppp 6241 * Releases a reference to the passed conn_t. 6242 */ 6243 static void 6244 ipsec_conn_pol(ipsec_selector_t *sel, conn_t *connp, ipsec_policy_t **ppp) 6245 { 6246 ipsec_policy_t *pp; 6247 ipsec_latch_t *ipl = connp->conn_latch; 6248 6249 if ((ipl != NULL) && (ipl->ipl_out_policy != NULL)) { 6250 pp = ipl->ipl_out_policy; 6251 IPPOL_REFHOLD(pp); 6252 } else { 6253 pp = ipsec_find_policy(IPSEC_TYPE_OUTBOUND, connp, NULL, sel, 6254 connp->conn_netstack); 6255 } 6256 *ppp = pp; 6257 CONN_DEC_REF(connp); 6258 } 6259 6260 /* 6261 * The following functions scan through active conn_t structures 6262 * and return a reference to the best-matching policy it can find. 6263 * Caller must release the reference. 6264 */ 6265 static void 6266 ipsec_udp_pol(ipsec_selector_t *sel, ipsec_policy_t **ppp, ip_stack_t *ipst) 6267 { 6268 connf_t *connfp; 6269 conn_t *connp = NULL; 6270 ipsec_selector_t portonly; 6271 6272 bzero((void *)&portonly, sizeof (portonly)); 6273 6274 if (sel->ips_local_port == 0) 6275 return; 6276 6277 connfp = &ipst->ips_ipcl_udp_fanout[IPCL_UDP_HASH(sel->ips_local_port, 6278 ipst)]; 6279 mutex_enter(&connfp->connf_lock); 6280 6281 if (sel->ips_isv4) { 6282 connp = connfp->connf_head; 6283 while (connp != NULL) { 6284 if (IPCL_UDP_MATCH(connp, sel->ips_local_port, 6285 sel->ips_local_addr_v4, sel->ips_remote_port, 6286 sel->ips_remote_addr_v4)) 6287 break; 6288 connp = connp->conn_next; 6289 } 6290 6291 if (connp == NULL) { 6292 /* Try port-only match in IPv6. */ 6293 portonly.ips_local_port = sel->ips_local_port; 6294 sel = &portonly; 6295 } 6296 } 6297 6298 if (connp == NULL) { 6299 connp = connfp->connf_head; 6300 while (connp != NULL) { 6301 if (IPCL_UDP_MATCH_V6(connp, sel->ips_local_port, 6302 sel->ips_local_addr_v6, sel->ips_remote_port, 6303 sel->ips_remote_addr_v6)) 6304 break; 6305 connp = connp->conn_next; 6306 } 6307 6308 if (connp == NULL) { 6309 mutex_exit(&connfp->connf_lock); 6310 return; 6311 } 6312 } 6313 6314 CONN_INC_REF(connp); 6315 mutex_exit(&connfp->connf_lock); 6316 6317 ipsec_conn_pol(sel, connp, ppp); 6318 } 6319 6320 static conn_t * 6321 ipsec_find_listen_conn(uint16_t *pptr, ipsec_selector_t *sel, ip_stack_t *ipst) 6322 { 6323 connf_t *connfp; 6324 conn_t *connp = NULL; 6325 const in6_addr_t *v6addrmatch = &sel->ips_local_addr_v6; 6326 6327 if (sel->ips_local_port == 0) 6328 return (NULL); 6329 6330 connfp = &ipst->ips_ipcl_bind_fanout[ 6331 IPCL_BIND_HASH(sel->ips_local_port, ipst)]; 6332 mutex_enter(&connfp->connf_lock); 6333 6334 if (sel->ips_isv4) { 6335 connp = connfp->connf_head; 6336 while (connp != NULL) { 6337 if (IPCL_BIND_MATCH(connp, IPPROTO_TCP, 6338 sel->ips_local_addr_v4, pptr[1])) 6339 break; 6340 connp = connp->conn_next; 6341 } 6342 6343 if (connp == NULL) { 6344 /* Match to all-zeroes. */ 6345 v6addrmatch = &ipv6_all_zeros; 6346 } 6347 } 6348 6349 if (connp == NULL) { 6350 connp = connfp->connf_head; 6351 while (connp != NULL) { 6352 if (IPCL_BIND_MATCH_V6(connp, IPPROTO_TCP, 6353 *v6addrmatch, pptr[1])) 6354 break; 6355 connp = connp->conn_next; 6356 } 6357 6358 if (connp == NULL) { 6359 mutex_exit(&connfp->connf_lock); 6360 return (NULL); 6361 } 6362 } 6363 6364 CONN_INC_REF(connp); 6365 mutex_exit(&connfp->connf_lock); 6366 return (connp); 6367 } 6368 6369 static void 6370 ipsec_tcp_pol(ipsec_selector_t *sel, ipsec_policy_t **ppp, ip_stack_t *ipst) 6371 { 6372 connf_t *connfp; 6373 conn_t *connp; 6374 uint32_t ports; 6375 uint16_t *pptr = (uint16_t *)&ports; 6376 6377 /* 6378 * Find TCP state in the following order: 6379 * 1.) Connected conns. 6380 * 2.) Listeners. 6381 * 6382 * Even though #2 will be the common case for inbound traffic, only 6383 * following this order insures correctness. 6384 */ 6385 6386 if (sel->ips_local_port == 0) 6387 return; 6388 6389 /* 6390 * 0 should be fport, 1 should be lport. SRC is the local one here. 6391 * See ipsec_construct_inverse_acquire() for details. 6392 */ 6393 pptr[0] = sel->ips_remote_port; 6394 pptr[1] = sel->ips_local_port; 6395 6396 connfp = &ipst->ips_ipcl_conn_fanout[ 6397 IPCL_CONN_HASH(sel->ips_remote_addr_v4, ports, ipst)]; 6398 mutex_enter(&connfp->connf_lock); 6399 connp = connfp->connf_head; 6400 6401 if (sel->ips_isv4) { 6402 while (connp != NULL) { 6403 if (IPCL_CONN_MATCH(connp, IPPROTO_TCP, 6404 sel->ips_remote_addr_v4, sel->ips_local_addr_v4, 6405 ports)) 6406 break; 6407 connp = connp->conn_next; 6408 } 6409 } else { 6410 while (connp != NULL) { 6411 if (IPCL_CONN_MATCH_V6(connp, IPPROTO_TCP, 6412 sel->ips_remote_addr_v6, sel->ips_local_addr_v6, 6413 ports)) 6414 break; 6415 connp = connp->conn_next; 6416 } 6417 } 6418 6419 if (connp != NULL) { 6420 CONN_INC_REF(connp); 6421 mutex_exit(&connfp->connf_lock); 6422 } else { 6423 mutex_exit(&connfp->connf_lock); 6424 6425 /* Try the listen hash. */ 6426 if ((connp = ipsec_find_listen_conn(pptr, sel, ipst)) == NULL) 6427 return; 6428 } 6429 6430 ipsec_conn_pol(sel, connp, ppp); 6431 } 6432 6433 static void 6434 ipsec_sctp_pol(ipsec_selector_t *sel, ipsec_policy_t **ppp, 6435 ip_stack_t *ipst) 6436 { 6437 conn_t *connp; 6438 uint32_t ports; 6439 uint16_t *pptr = (uint16_t *)&ports; 6440 6441 /* 6442 * Find SCP state in the following order: 6443 * 1.) Connected conns. 6444 * 2.) Listeners. 6445 * 6446 * Even though #2 will be the common case for inbound traffic, only 6447 * following this order insures correctness. 6448 */ 6449 6450 if (sel->ips_local_port == 0) 6451 return; 6452 6453 /* 6454 * 0 should be fport, 1 should be lport. SRC is the local one here. 6455 * See ipsec_construct_inverse_acquire() for details. 6456 */ 6457 pptr[0] = sel->ips_remote_port; 6458 pptr[1] = sel->ips_local_port; 6459 6460 if (sel->ips_isv4) { 6461 in6_addr_t src, dst; 6462 6463 IN6_IPADDR_TO_V4MAPPED(sel->ips_remote_addr_v4, &dst); 6464 IN6_IPADDR_TO_V4MAPPED(sel->ips_local_addr_v4, &src); 6465 connp = sctp_find_conn(&dst, &src, ports, ALL_ZONES, 6466 ipst->ips_netstack->netstack_sctp); 6467 } else { 6468 connp = sctp_find_conn(&sel->ips_remote_addr_v6, 6469 &sel->ips_local_addr_v6, ports, ALL_ZONES, 6470 ipst->ips_netstack->netstack_sctp); 6471 } 6472 if (connp == NULL) 6473 return; 6474 ipsec_conn_pol(sel, connp, ppp); 6475 } 6476 6477 /* 6478 * Fill in a query for the SPD (in "sel") using two PF_KEY address extensions. 6479 * Returns 0 or errno, and always sets *diagnostic to something appropriate 6480 * to PF_KEY. 6481 * 6482 * NOTE: For right now, this function (and ipsec_selector_t for that matter), 6483 * ignore prefix lengths in the address extension. Since we match on first- 6484 * entered policies, this shouldn't matter. Also, since we normalize prefix- 6485 * set addresses to mask out the lower bits, we should get a suitable search 6486 * key for the SPD anyway. This is the function to change if the assumption 6487 * about suitable search keys is wrong. 6488 */ 6489 static int 6490 ipsec_get_inverse_acquire_sel(ipsec_selector_t *sel, sadb_address_t *srcext, 6491 sadb_address_t *dstext, int *diagnostic) 6492 { 6493 struct sockaddr_in *src, *dst; 6494 struct sockaddr_in6 *src6, *dst6; 6495 6496 *diagnostic = 0; 6497 6498 bzero(sel, sizeof (*sel)); 6499 sel->ips_protocol = srcext->sadb_address_proto; 6500 dst = (struct sockaddr_in *)(dstext + 1); 6501 if (dst->sin_family == AF_INET6) { 6502 dst6 = (struct sockaddr_in6 *)dst; 6503 src6 = (struct sockaddr_in6 *)(srcext + 1); 6504 if (src6->sin6_family != AF_INET6) { 6505 *diagnostic = SADB_X_DIAGNOSTIC_AF_MISMATCH; 6506 return (EINVAL); 6507 } 6508 sel->ips_remote_addr_v6 = dst6->sin6_addr; 6509 sel->ips_local_addr_v6 = src6->sin6_addr; 6510 if (sel->ips_protocol == IPPROTO_ICMPV6) { 6511 sel->ips_is_icmp_inv_acq = 1; 6512 } else { 6513 sel->ips_remote_port = dst6->sin6_port; 6514 sel->ips_local_port = src6->sin6_port; 6515 } 6516 sel->ips_isv4 = B_FALSE; 6517 } else { 6518 src = (struct sockaddr_in *)(srcext + 1); 6519 if (src->sin_family != AF_INET) { 6520 *diagnostic = SADB_X_DIAGNOSTIC_AF_MISMATCH; 6521 return (EINVAL); 6522 } 6523 sel->ips_remote_addr_v4 = dst->sin_addr.s_addr; 6524 sel->ips_local_addr_v4 = src->sin_addr.s_addr; 6525 if (sel->ips_protocol == IPPROTO_ICMP) { 6526 sel->ips_is_icmp_inv_acq = 1; 6527 } else { 6528 sel->ips_remote_port = dst->sin_port; 6529 sel->ips_local_port = src->sin_port; 6530 } 6531 sel->ips_isv4 = B_TRUE; 6532 } 6533 return (0); 6534 } 6535 6536 /* 6537 * We have encapsulation. 6538 * - Lookup tun_t by address and look for an associated 6539 * tunnel policy 6540 * - If there are inner selectors 6541 * - check ITPF_P_TUNNEL and ITPF_P_ACTIVE 6542 * - Look up tunnel policy based on selectors 6543 * - Else 6544 * - Sanity check the negotation 6545 * - If appropriate, fall through to global policy 6546 */ 6547 static int 6548 ipsec_tun_pol(ipsec_selector_t *sel, ipsec_policy_t **ppp, 6549 sadb_address_t *innsrcext, sadb_address_t *inndstext, ipsec_tun_pol_t *itp, 6550 int *diagnostic, netstack_t *ns) 6551 { 6552 int err; 6553 ipsec_policy_head_t *polhead; 6554 6555 /* Check for inner selectors and act appropriately */ 6556 6557 if (innsrcext != NULL) { 6558 /* Inner selectors present */ 6559 ASSERT(inndstext != NULL); 6560 if ((itp == NULL) || 6561 (itp->itp_flags & (ITPF_P_ACTIVE | ITPF_P_TUNNEL)) != 6562 (ITPF_P_ACTIVE | ITPF_P_TUNNEL)) { 6563 /* 6564 * If inner packet selectors, we must have negotiate 6565 * tunnel and active policy. If the tunnel has 6566 * transport-mode policy set on it, or has no policy, 6567 * fail. 6568 */ 6569 return (ENOENT); 6570 } else { 6571 /* 6572 * Reset "sel" to indicate inner selectors. Pass 6573 * inner PF_KEY address extensions for this to happen. 6574 */ 6575 err = ipsec_get_inverse_acquire_sel(sel, 6576 innsrcext, inndstext, diagnostic); 6577 if (err != 0) { 6578 ITP_REFRELE(itp, ns); 6579 return (err); 6580 } 6581 /* 6582 * Now look for a tunnel policy based on those inner 6583 * selectors. (Common code is below.) 6584 */ 6585 } 6586 } else { 6587 /* No inner selectors present */ 6588 if ((itp == NULL) || !(itp->itp_flags & ITPF_P_ACTIVE)) { 6589 /* 6590 * Transport mode negotiation with no tunnel policy 6591 * configured - return to indicate a global policy 6592 * check is needed. 6593 */ 6594 if (itp != NULL) { 6595 ITP_REFRELE(itp, ns); 6596 } 6597 return (0); 6598 } else if (itp->itp_flags & ITPF_P_TUNNEL) { 6599 /* Tunnel mode set with no inner selectors. */ 6600 ITP_REFRELE(itp, ns); 6601 return (ENOENT); 6602 } 6603 /* 6604 * Else, this is a tunnel policy configured with ifconfig(1m) 6605 * or "negotiate transport" with ipsecconf(1m). We have an 6606 * itp with policy set based on any match, so don't bother 6607 * changing fields in "sel". 6608 */ 6609 } 6610 6611 ASSERT(itp != NULL); 6612 polhead = itp->itp_policy; 6613 ASSERT(polhead != NULL); 6614 rw_enter(&polhead->iph_lock, RW_READER); 6615 *ppp = ipsec_find_policy_head(NULL, polhead, 6616 IPSEC_TYPE_INBOUND, sel, ns); 6617 rw_exit(&polhead->iph_lock); 6618 ITP_REFRELE(itp, ns); 6619 6620 /* 6621 * Don't default to global if we didn't find a matching policy entry. 6622 * Instead, send ENOENT, just like if we hit a transport-mode tunnel. 6623 */ 6624 if (*ppp == NULL) 6625 return (ENOENT); 6626 6627 return (0); 6628 } 6629 6630 static void 6631 ipsec_oth_pol(ipsec_selector_t *sel, ipsec_policy_t **ppp, 6632 ip_stack_t *ipst) 6633 { 6634 boolean_t isv4 = sel->ips_isv4; 6635 connf_t *connfp; 6636 conn_t *connp; 6637 6638 if (isv4) { 6639 connfp = &ipst->ips_ipcl_proto_fanout[sel->ips_protocol]; 6640 } else { 6641 connfp = &ipst->ips_ipcl_proto_fanout_v6[sel->ips_protocol]; 6642 } 6643 6644 mutex_enter(&connfp->connf_lock); 6645 for (connp = connfp->connf_head; connp != NULL; 6646 connp = connp->conn_next) { 6647 if (!((isv4 && !((connp->conn_src == 0 || 6648 connp->conn_src == sel->ips_local_addr_v4) && 6649 (connp->conn_rem == 0 || 6650 connp->conn_rem == sel->ips_remote_addr_v4))) || 6651 (!isv4 && !((IN6_IS_ADDR_UNSPECIFIED(&connp->conn_srcv6) || 6652 IN6_ARE_ADDR_EQUAL(&connp->conn_srcv6, 6653 &sel->ips_local_addr_v6)) && 6654 (IN6_IS_ADDR_UNSPECIFIED(&connp->conn_remv6) || 6655 IN6_ARE_ADDR_EQUAL(&connp->conn_remv6, 6656 &sel->ips_remote_addr_v6)))))) { 6657 break; 6658 } 6659 } 6660 if (connp == NULL) { 6661 mutex_exit(&connfp->connf_lock); 6662 return; 6663 } 6664 6665 CONN_INC_REF(connp); 6666 mutex_exit(&connfp->connf_lock); 6667 6668 ipsec_conn_pol(sel, connp, ppp); 6669 } 6670 6671 /* 6672 * Construct an inverse ACQUIRE reply based on: 6673 * 6674 * 1.) Current global policy. 6675 * 2.) An conn_t match depending on what all was passed in the extv[]. 6676 * 3.) A tunnel's policy head. 6677 * ... 6678 * N.) Other stuff TBD (e.g. identities) 6679 * 6680 * If there is an error, set sadb_msg_errno and sadb_x_msg_diagnostic 6681 * in this function so the caller can extract them where appropriately. 6682 * 6683 * The SRC address is the local one - just like an outbound ACQUIRE message. 6684 */ 6685 mblk_t * 6686 ipsec_construct_inverse_acquire(sadb_msg_t *samsg, sadb_ext_t *extv[], 6687 netstack_t *ns) 6688 { 6689 int err; 6690 int diagnostic; 6691 sadb_address_t *srcext = (sadb_address_t *)extv[SADB_EXT_ADDRESS_SRC], 6692 *dstext = (sadb_address_t *)extv[SADB_EXT_ADDRESS_DST], 6693 *innsrcext = (sadb_address_t *)extv[SADB_X_EXT_ADDRESS_INNER_SRC], 6694 *inndstext = (sadb_address_t *)extv[SADB_X_EXT_ADDRESS_INNER_DST]; 6695 struct sockaddr_in6 *src, *dst; 6696 struct sockaddr_in6 *isrc, *idst; 6697 ipsec_tun_pol_t *itp = NULL; 6698 ipsec_policy_t *pp = NULL; 6699 ipsec_selector_t sel, isel; 6700 mblk_t *retmp; 6701 ip_stack_t *ipst = ns->netstack_ip; 6702 ipsec_stack_t *ipss = ns->netstack_ipsec; 6703 6704 /* Normalize addresses */ 6705 if (sadb_addrcheck(NULL, (mblk_t *)samsg, (sadb_ext_t *)srcext, 0, ns) 6706 == KS_IN_ADDR_UNKNOWN) { 6707 err = EINVAL; 6708 diagnostic = SADB_X_DIAGNOSTIC_BAD_SRC; 6709 goto bail; 6710 } 6711 src = (struct sockaddr_in6 *)(srcext + 1); 6712 if (sadb_addrcheck(NULL, (mblk_t *)samsg, (sadb_ext_t *)dstext, 0, ns) 6713 == KS_IN_ADDR_UNKNOWN) { 6714 err = EINVAL; 6715 diagnostic = SADB_X_DIAGNOSTIC_BAD_DST; 6716 goto bail; 6717 } 6718 dst = (struct sockaddr_in6 *)(dstext + 1); 6719 if (src->sin6_family != dst->sin6_family) { 6720 err = EINVAL; 6721 diagnostic = SADB_X_DIAGNOSTIC_AF_MISMATCH; 6722 goto bail; 6723 } 6724 6725 /* Check for tunnel mode and act appropriately */ 6726 if (innsrcext != NULL) { 6727 if (inndstext == NULL) { 6728 err = EINVAL; 6729 diagnostic = SADB_X_DIAGNOSTIC_MISSING_INNER_DST; 6730 goto bail; 6731 } 6732 if (sadb_addrcheck(NULL, (mblk_t *)samsg, 6733 (sadb_ext_t *)innsrcext, 0, ns) == KS_IN_ADDR_UNKNOWN) { 6734 err = EINVAL; 6735 diagnostic = SADB_X_DIAGNOSTIC_MALFORMED_INNER_SRC; 6736 goto bail; 6737 } 6738 isrc = (struct sockaddr_in6 *)(innsrcext + 1); 6739 if (sadb_addrcheck(NULL, (mblk_t *)samsg, 6740 (sadb_ext_t *)inndstext, 0, ns) == KS_IN_ADDR_UNKNOWN) { 6741 err = EINVAL; 6742 diagnostic = SADB_X_DIAGNOSTIC_MALFORMED_INNER_DST; 6743 goto bail; 6744 } 6745 idst = (struct sockaddr_in6 *)(inndstext + 1); 6746 if (isrc->sin6_family != idst->sin6_family) { 6747 err = EINVAL; 6748 diagnostic = SADB_X_DIAGNOSTIC_INNER_AF_MISMATCH; 6749 goto bail; 6750 } 6751 if (isrc->sin6_family != AF_INET && 6752 isrc->sin6_family != AF_INET6) { 6753 err = EINVAL; 6754 diagnostic = SADB_X_DIAGNOSTIC_BAD_INNER_SRC_AF; 6755 goto bail; 6756 } 6757 } else if (inndstext != NULL) { 6758 err = EINVAL; 6759 diagnostic = SADB_X_DIAGNOSTIC_MISSING_INNER_SRC; 6760 goto bail; 6761 } 6762 6763 /* Get selectors first, based on outer addresses */ 6764 err = ipsec_get_inverse_acquire_sel(&sel, srcext, dstext, &diagnostic); 6765 if (err != 0) 6766 goto bail; 6767 6768 /* Check for tunnel mode mismatches. */ 6769 if (innsrcext != NULL && 6770 ((isrc->sin6_family == AF_INET && 6771 sel.ips_protocol != IPPROTO_ENCAP && sel.ips_protocol != 0) || 6772 (isrc->sin6_family == AF_INET6 && 6773 sel.ips_protocol != IPPROTO_IPV6 && sel.ips_protocol != 0))) { 6774 err = EPROTOTYPE; 6775 goto bail; 6776 } 6777 6778 /* 6779 * Okay, we have the addresses and other selector information. 6780 * Let's first find a conn... 6781 */ 6782 pp = NULL; 6783 switch (sel.ips_protocol) { 6784 case IPPROTO_TCP: 6785 ipsec_tcp_pol(&sel, &pp, ipst); 6786 break; 6787 case IPPROTO_UDP: 6788 ipsec_udp_pol(&sel, &pp, ipst); 6789 break; 6790 case IPPROTO_SCTP: 6791 ipsec_sctp_pol(&sel, &pp, ipst); 6792 break; 6793 case IPPROTO_ENCAP: 6794 case IPPROTO_IPV6: 6795 rw_enter(&ipss->ipsec_itp_get_byaddr_rw_lock, RW_READER); 6796 /* 6797 * Assume sel.ips_remote_addr_* has the right address at 6798 * that exact position. 6799 */ 6800 itp = ipss->ipsec_itp_get_byaddr( 6801 (uint32_t *)(&sel.ips_local_addr_v6), 6802 (uint32_t *)(&sel.ips_remote_addr_v6), 6803 src->sin6_family, ns); 6804 rw_exit(&ipss->ipsec_itp_get_byaddr_rw_lock); 6805 if (innsrcext == NULL) { 6806 /* 6807 * Transport-mode tunnel, make sure we fake out isel 6808 * to contain something based on the outer protocol. 6809 */ 6810 bzero(&isel, sizeof (isel)); 6811 isel.ips_isv4 = (sel.ips_protocol == IPPROTO_ENCAP); 6812 } /* Else isel is initialized by ipsec_tun_pol(). */ 6813 err = ipsec_tun_pol(&isel, &pp, innsrcext, inndstext, itp, 6814 &diagnostic, ns); 6815 /* 6816 * NOTE: isel isn't used for now, but in RFC 430x IPsec, it 6817 * may be. 6818 */ 6819 if (err != 0) 6820 goto bail; 6821 break; 6822 default: 6823 ipsec_oth_pol(&sel, &pp, ipst); 6824 break; 6825 } 6826 6827 /* 6828 * If we didn't find a matching conn_t or other policy head, take a 6829 * look in the global policy. 6830 */ 6831 if (pp == NULL) { 6832 pp = ipsec_find_policy(IPSEC_TYPE_OUTBOUND, NULL, NULL, &sel, 6833 ns); 6834 if (pp == NULL) { 6835 /* There's no global policy. */ 6836 err = ENOENT; 6837 diagnostic = 0; 6838 goto bail; 6839 } 6840 } 6841 6842 /* 6843 * Now that we have a policy entry/widget, construct an ACQUIRE 6844 * message based on that, fix fields where appropriate, 6845 * and return the message. 6846 */ 6847 retmp = sadb_extended_acquire(&sel, pp, NULL, 6848 (itp != NULL && (itp->itp_flags & ITPF_P_TUNNEL)), 6849 samsg->sadb_msg_seq, samsg->sadb_msg_pid, ns); 6850 if (pp != NULL) { 6851 IPPOL_REFRELE(pp, ns); 6852 } 6853 if (retmp != NULL) { 6854 return (retmp); 6855 } else { 6856 err = ENOMEM; 6857 diagnostic = 0; 6858 } 6859 bail: 6860 samsg->sadb_msg_errno = (uint8_t)err; 6861 samsg->sadb_x_msg_diagnostic = (uint16_t)diagnostic; 6862 return (NULL); 6863 } 6864 6865 /* 6866 * ipsa_lpkt is a one-element queue, only manipulated by the next two 6867 * functions. They have to hold the ipsa_lock because of potential races 6868 * between key management using SADB_UPDATE, and inbound packets that may 6869 * queue up on the larval SA (hence the 'l' in "lpkt"). 6870 */ 6871 6872 /* 6873 * sadb_set_lpkt: Return TRUE if we can swap in a value to ipsa->ipsa_lpkt and 6874 * freemsg the previous value. Return FALSE if we lost the race and the SA is 6875 * in a non-LARVAL state. free clue: ip_drop_packet(NULL) is safe. 6876 */ 6877 boolean_t 6878 sadb_set_lpkt(ipsa_t *ipsa, mblk_t *npkt, netstack_t *ns) 6879 { 6880 mblk_t *opkt; 6881 ipsec_stack_t *ipss = ns->netstack_ipsec; 6882 boolean_t is_larval; 6883 6884 /* 6885 * Check the packet's netstack id in case we go asynch with a 6886 * taskq_dispatch. 6887 */ 6888 ASSERT(((ipsec_in_t *)npkt->b_rptr)->ipsec_in_type == IPSEC_IN); 6889 ASSERT(((ipsec_in_t *)npkt->b_rptr)->ipsec_in_stackid == 6890 ns->netstack_stackid); 6891 6892 mutex_enter(&ipsa->ipsa_lock); 6893 is_larval = (ipsa->ipsa_state == IPSA_STATE_LARVAL); 6894 if (is_larval) { 6895 opkt = ipsa->ipsa_lpkt; 6896 ipsa->ipsa_lpkt = npkt; 6897 } else { 6898 /* We lost the race. */ 6899 opkt = NULL; 6900 ASSERT(ipsa->ipsa_lpkt == NULL); 6901 } 6902 mutex_exit(&ipsa->ipsa_lock); 6903 6904 ip_drop_packet(opkt, B_TRUE, NULL, NULL, 6905 DROPPER(ipss, ipds_sadb_inlarval_replace), 6906 &ipss->ipsec_sadb_dropper); 6907 return (is_larval); 6908 } 6909 6910 /* 6911 * sadb_clear_lpkt: Atomically clear ipsa->ipsa_lpkt and return the 6912 * previous value. 6913 */ 6914 mblk_t * 6915 sadb_clear_lpkt(ipsa_t *ipsa) 6916 { 6917 mblk_t *opkt; 6918 6919 mutex_enter(&ipsa->ipsa_lock); 6920 opkt = ipsa->ipsa_lpkt; 6921 ipsa->ipsa_lpkt = NULL; 6922 mutex_exit(&ipsa->ipsa_lock); 6923 6924 return (opkt); 6925 } 6926 6927 /* 6928 * Buffer a packet that's in IDLE state as set by Solaris Clustering. 6929 */ 6930 void 6931 sadb_buf_pkt(ipsa_t *ipsa, mblk_t *bpkt, netstack_t *ns) 6932 { 6933 ipsec_stack_t *ipss = ns->netstack_ipsec; 6934 extern void (*cl_inet_idlesa)(netstackid_t, uint8_t, uint32_t, 6935 sa_family_t, in6_addr_t, in6_addr_t, void *); 6936 in6_addr_t *srcaddr = (in6_addr_t *)(&ipsa->ipsa_srcaddr); 6937 in6_addr_t *dstaddr = (in6_addr_t *)(&ipsa->ipsa_dstaddr); 6938 6939 ASSERT(ipsa->ipsa_state == IPSA_STATE_IDLE); 6940 6941 if (cl_inet_idlesa == NULL) { 6942 ip_drop_packet(bpkt, B_TRUE, NULL, NULL, 6943 DROPPER(ipss, ipds_sadb_inidle_overflow), 6944 &ipss->ipsec_sadb_dropper); 6945 return; 6946 } 6947 6948 cl_inet_idlesa(ns->netstack_stackid, 6949 (ipsa->ipsa_type == SADB_SATYPE_AH) ? IPPROTO_AH : IPPROTO_ESP, 6950 ipsa->ipsa_spi, ipsa->ipsa_addrfam, *srcaddr, *dstaddr, NULL); 6951 6952 /* 6953 * Check the packet's netstack id in case we go asynch with a 6954 * taskq_dispatch. 6955 */ 6956 ASSERT(((ipsec_in_t *)bpkt->b_rptr)->ipsec_in_type == IPSEC_IN); 6957 ASSERT(((ipsec_in_t *)bpkt->b_rptr)->ipsec_in_stackid == 6958 ns->netstack_stackid); 6959 6960 mutex_enter(&ipsa->ipsa_lock); 6961 ipsa->ipsa_mblkcnt++; 6962 if (ipsa->ipsa_bpkt_head == NULL) { 6963 ipsa->ipsa_bpkt_head = ipsa->ipsa_bpkt_tail = bpkt; 6964 } else { 6965 ipsa->ipsa_bpkt_tail->b_next = bpkt; 6966 ipsa->ipsa_bpkt_tail = bpkt; 6967 if (ipsa->ipsa_mblkcnt > SADB_MAX_IDLEPKTS) { 6968 mblk_t *tmp; 6969 tmp = ipsa->ipsa_bpkt_head; 6970 ipsa->ipsa_bpkt_head = ipsa->ipsa_bpkt_head->b_next; 6971 ip_drop_packet(tmp, B_TRUE, NULL, NULL, 6972 DROPPER(ipss, ipds_sadb_inidle_overflow), 6973 &ipss->ipsec_sadb_dropper); 6974 ipsa->ipsa_mblkcnt --; 6975 } 6976 } 6977 mutex_exit(&ipsa->ipsa_lock); 6978 6979 } 6980 6981 /* 6982 * Stub function that taskq_dispatch() invokes to take the mblk (in arg) 6983 * and put into STREAMS again. 6984 */ 6985 void 6986 sadb_clear_buf_pkt(void *ipkt) 6987 { 6988 mblk_t *tmp, *buf_pkt; 6989 netstack_t *ns; 6990 ipsec_in_t *ii; 6991 6992 buf_pkt = (mblk_t *)ipkt; 6993 6994 ii = (ipsec_in_t *)buf_pkt->b_rptr; 6995 ASSERT(ii->ipsec_in_type == IPSEC_IN); 6996 ns = netstack_find_by_stackid(ii->ipsec_in_stackid); 6997 if (ns != NULL && ns != ii->ipsec_in_ns) { 6998 netstack_rele(ns); 6999 ns = NULL; /* For while-loop below. */ 7000 } 7001 7002 while (buf_pkt != NULL) { 7003 tmp = buf_pkt->b_next; 7004 buf_pkt->b_next = NULL; 7005 if (ns != NULL) 7006 ip_fanout_proto_again(buf_pkt, NULL, NULL, NULL); 7007 else 7008 freemsg(buf_pkt); 7009 buf_pkt = tmp; 7010 } 7011 if (ns != NULL) 7012 netstack_rele(ns); 7013 } 7014 /* 7015 * Walker callback used by sadb_alg_update() to free/create crypto 7016 * context template when a crypto software provider is removed or 7017 * added. 7018 */ 7019 7020 struct sadb_update_alg_state { 7021 ipsec_algtype_t alg_type; 7022 uint8_t alg_id; 7023 boolean_t is_added; 7024 }; 7025 7026 static void 7027 sadb_alg_update_cb(isaf_t *head, ipsa_t *entry, void *cookie) 7028 { 7029 struct sadb_update_alg_state *update_state = 7030 (struct sadb_update_alg_state *)cookie; 7031 crypto_ctx_template_t *ctx_tmpl = NULL; 7032 7033 ASSERT(MUTEX_HELD(&head->isaf_lock)); 7034 7035 if (entry->ipsa_state == IPSA_STATE_LARVAL) 7036 return; 7037 7038 mutex_enter(&entry->ipsa_lock); 7039 7040 switch (update_state->alg_type) { 7041 case IPSEC_ALG_AUTH: 7042 if (entry->ipsa_auth_alg == update_state->alg_id) 7043 ctx_tmpl = &entry->ipsa_authtmpl; 7044 break; 7045 case IPSEC_ALG_ENCR: 7046 if (entry->ipsa_encr_alg == update_state->alg_id) 7047 ctx_tmpl = &entry->ipsa_encrtmpl; 7048 break; 7049 default: 7050 ctx_tmpl = NULL; 7051 } 7052 7053 if (ctx_tmpl == NULL) { 7054 mutex_exit(&entry->ipsa_lock); 7055 return; 7056 } 7057 7058 /* 7059 * The context template of the SA may be affected by the change 7060 * of crypto provider. 7061 */ 7062 if (update_state->is_added) { 7063 /* create the context template if not already done */ 7064 if (*ctx_tmpl == NULL) { 7065 (void) ipsec_create_ctx_tmpl(entry, 7066 update_state->alg_type); 7067 } 7068 } else { 7069 /* 7070 * The crypto provider was removed. If the context template 7071 * exists but it is no longer valid, free it. 7072 */ 7073 if (*ctx_tmpl != NULL) 7074 ipsec_destroy_ctx_tmpl(entry, update_state->alg_type); 7075 } 7076 7077 mutex_exit(&entry->ipsa_lock); 7078 } 7079 7080 /* 7081 * Invoked by IP when an software crypto provider has been updated. 7082 * The type and id of the corresponding algorithm is passed as argument. 7083 * is_added is B_TRUE if the provider was added, B_FALSE if it was 7084 * removed. The function updates the SADB and free/creates the 7085 * context templates associated with SAs if needed. 7086 */ 7087 7088 #define SADB_ALG_UPDATE_WALK(sadb, table) \ 7089 sadb_walker((sadb).table, (sadb).sdb_hashsize, sadb_alg_update_cb, \ 7090 &update_state) 7091 7092 void 7093 sadb_alg_update(ipsec_algtype_t alg_type, uint8_t alg_id, boolean_t is_added, 7094 netstack_t *ns) 7095 { 7096 struct sadb_update_alg_state update_state; 7097 ipsecah_stack_t *ahstack = ns->netstack_ipsecah; 7098 ipsecesp_stack_t *espstack = ns->netstack_ipsecesp; 7099 7100 update_state.alg_type = alg_type; 7101 update_state.alg_id = alg_id; 7102 update_state.is_added = is_added; 7103 7104 if (alg_type == IPSEC_ALG_AUTH) { 7105 /* walk the AH tables only for auth. algorithm changes */ 7106 SADB_ALG_UPDATE_WALK(ahstack->ah_sadb.s_v4, sdb_of); 7107 SADB_ALG_UPDATE_WALK(ahstack->ah_sadb.s_v4, sdb_if); 7108 SADB_ALG_UPDATE_WALK(ahstack->ah_sadb.s_v6, sdb_of); 7109 SADB_ALG_UPDATE_WALK(ahstack->ah_sadb.s_v6, sdb_if); 7110 } 7111 7112 /* walk the ESP tables */ 7113 SADB_ALG_UPDATE_WALK(espstack->esp_sadb.s_v4, sdb_of); 7114 SADB_ALG_UPDATE_WALK(espstack->esp_sadb.s_v4, sdb_if); 7115 SADB_ALG_UPDATE_WALK(espstack->esp_sadb.s_v6, sdb_of); 7116 SADB_ALG_UPDATE_WALK(espstack->esp_sadb.s_v6, sdb_if); 7117 } 7118 7119 /* 7120 * Creates a context template for the specified SA. This function 7121 * is called when an SA is created and when a context template needs 7122 * to be created due to a change of software provider. 7123 */ 7124 int 7125 ipsec_create_ctx_tmpl(ipsa_t *sa, ipsec_algtype_t alg_type) 7126 { 7127 ipsec_alginfo_t *alg; 7128 crypto_mechanism_t mech; 7129 crypto_key_t *key; 7130 crypto_ctx_template_t *sa_tmpl; 7131 int rv; 7132 ipsec_stack_t *ipss = sa->ipsa_netstack->netstack_ipsec; 7133 7134 ASSERT(MUTEX_HELD(&ipss->ipsec_alg_lock)); 7135 ASSERT(MUTEX_HELD(&sa->ipsa_lock)); 7136 7137 /* get pointers to the algorithm info, context template, and key */ 7138 switch (alg_type) { 7139 case IPSEC_ALG_AUTH: 7140 key = &sa->ipsa_kcfauthkey; 7141 sa_tmpl = &sa->ipsa_authtmpl; 7142 alg = ipss->ipsec_alglists[alg_type][sa->ipsa_auth_alg]; 7143 break; 7144 case IPSEC_ALG_ENCR: 7145 key = &sa->ipsa_kcfencrkey; 7146 sa_tmpl = &sa->ipsa_encrtmpl; 7147 alg = ipss->ipsec_alglists[alg_type][sa->ipsa_encr_alg]; 7148 break; 7149 default: 7150 alg = NULL; 7151 } 7152 7153 if (alg == NULL || !ALG_VALID(alg)) 7154 return (EINVAL); 7155 7156 /* initialize the mech info structure for the framework */ 7157 ASSERT(alg->alg_mech_type != CRYPTO_MECHANISM_INVALID); 7158 mech.cm_type = alg->alg_mech_type; 7159 mech.cm_param = NULL; 7160 mech.cm_param_len = 0; 7161 7162 /* create a new context template */ 7163 rv = crypto_create_ctx_template(&mech, key, sa_tmpl, KM_NOSLEEP); 7164 7165 /* 7166 * CRYPTO_MECH_NOT_SUPPORTED can be returned if only hardware 7167 * providers are available for that mechanism. In that case 7168 * we don't fail, and will generate the context template from 7169 * the framework callback when a software provider for that 7170 * mechanism registers. 7171 * 7172 * The context template is assigned the special value 7173 * IPSEC_CTX_TMPL_ALLOC if the allocation failed due to a 7174 * lack of memory. No attempt will be made to use 7175 * the context template if it is set to this value. 7176 */ 7177 if (rv == CRYPTO_HOST_MEMORY) { 7178 *sa_tmpl = IPSEC_CTX_TMPL_ALLOC; 7179 } else if (rv != CRYPTO_SUCCESS) { 7180 *sa_tmpl = NULL; 7181 if (rv != CRYPTO_MECH_NOT_SUPPORTED) 7182 return (EINVAL); 7183 } 7184 7185 return (0); 7186 } 7187 7188 /* 7189 * Destroy the context template of the specified algorithm type 7190 * of the specified SA. Must be called while holding the SA lock. 7191 */ 7192 void 7193 ipsec_destroy_ctx_tmpl(ipsa_t *sa, ipsec_algtype_t alg_type) 7194 { 7195 ASSERT(MUTEX_HELD(&sa->ipsa_lock)); 7196 7197 if (alg_type == IPSEC_ALG_AUTH) { 7198 if (sa->ipsa_authtmpl == IPSEC_CTX_TMPL_ALLOC) 7199 sa->ipsa_authtmpl = NULL; 7200 else if (sa->ipsa_authtmpl != NULL) { 7201 crypto_destroy_ctx_template(sa->ipsa_authtmpl); 7202 sa->ipsa_authtmpl = NULL; 7203 } 7204 } else { 7205 ASSERT(alg_type == IPSEC_ALG_ENCR); 7206 if (sa->ipsa_encrtmpl == IPSEC_CTX_TMPL_ALLOC) 7207 sa->ipsa_encrtmpl = NULL; 7208 else if (sa->ipsa_encrtmpl != NULL) { 7209 crypto_destroy_ctx_template(sa->ipsa_encrtmpl); 7210 sa->ipsa_encrtmpl = NULL; 7211 } 7212 } 7213 } 7214 7215 /* 7216 * Use the kernel crypto framework to check the validity of a key received 7217 * via keysock. Returns 0 if the key is OK, -1 otherwise. 7218 */ 7219 int 7220 ipsec_check_key(crypto_mech_type_t mech_type, sadb_key_t *sadb_key, 7221 boolean_t is_auth, int *diag) 7222 { 7223 crypto_mechanism_t mech; 7224 crypto_key_t crypto_key; 7225 int crypto_rc; 7226 7227 mech.cm_type = mech_type; 7228 mech.cm_param = NULL; 7229 mech.cm_param_len = 0; 7230 7231 crypto_key.ck_format = CRYPTO_KEY_RAW; 7232 crypto_key.ck_data = sadb_key + 1; 7233 crypto_key.ck_length = sadb_key->sadb_key_bits; 7234 7235 crypto_rc = crypto_key_check(&mech, &crypto_key); 7236 7237 switch (crypto_rc) { 7238 case CRYPTO_SUCCESS: 7239 return (0); 7240 case CRYPTO_MECHANISM_INVALID: 7241 case CRYPTO_MECH_NOT_SUPPORTED: 7242 *diag = is_auth ? SADB_X_DIAGNOSTIC_BAD_AALG : 7243 SADB_X_DIAGNOSTIC_BAD_EALG; 7244 break; 7245 case CRYPTO_KEY_SIZE_RANGE: 7246 *diag = is_auth ? SADB_X_DIAGNOSTIC_BAD_AKEYBITS : 7247 SADB_X_DIAGNOSTIC_BAD_EKEYBITS; 7248 break; 7249 case CRYPTO_WEAK_KEY: 7250 *diag = is_auth ? SADB_X_DIAGNOSTIC_WEAK_AKEY : 7251 SADB_X_DIAGNOSTIC_WEAK_EKEY; 7252 break; 7253 } 7254 7255 return (-1); 7256 } 7257 /* 7258 * If this is an outgoing SA then add some fuzz to the 7259 * SOFT EXPIRE time. The reason for this is to stop 7260 * peers trying to renegotiate SOFT expiring SA's at 7261 * the same time. The amount of fuzz needs to be at 7262 * least 8 seconds which is the typical interval 7263 * sadb_ager(), although this is only a guide as it 7264 * selftunes. 7265 */ 7266 void 7267 lifetime_fuzz(ipsa_t *assoc) 7268 { 7269 uint8_t rnd; 7270 7271 if (assoc->ipsa_softaddlt == 0) 7272 return; 7273 7274 (void) random_get_pseudo_bytes(&rnd, sizeof (rnd)); 7275 rnd = (rnd & 0xF) + 8; 7276 assoc->ipsa_softexpiretime -= rnd; 7277 assoc->ipsa_softaddlt -= rnd; 7278 } 7279 void 7280 destroy_ipsa_pair(ipsap_t *ipsapp) 7281 { 7282 if (ipsapp == NULL) 7283 return; 7284 7285 /* 7286 * Because of the multi-line macro nature of IPSA_REFRELE, keep 7287 * them in { }. 7288 */ 7289 if (ipsapp->ipsap_sa_ptr != NULL) { 7290 IPSA_REFRELE(ipsapp->ipsap_sa_ptr); 7291 } 7292 if (ipsapp->ipsap_psa_ptr != NULL) { 7293 IPSA_REFRELE(ipsapp->ipsap_psa_ptr); 7294 } 7295 7296 kmem_free(ipsapp, sizeof (*ipsapp)); 7297 } 7298 7299 /* 7300 * The sadb_ager() function walks through the hash tables of SA's and ages 7301 * them, if the SA expires as a result, its marked as DEAD and will be reaped 7302 * the next time sadb_ager() runs. SA's which are paired or have a peer (same 7303 * SA appears in both the inbound and outbound tables because its not possible 7304 * to determine its direction) are placed on a list when they expire. This is 7305 * to ensure that pair/peer SA's are reaped at the same time, even if they 7306 * expire at different times. 7307 * 7308 * This function is called twice by sadb_ager(), one after processing the 7309 * inbound table, then again after processing the outbound table. 7310 */ 7311 void 7312 age_pair_peer_list(templist_t *haspeerlist, sadb_t *sp, boolean_t outbound) 7313 { 7314 templist_t *listptr; 7315 int outhash; 7316 isaf_t *bucket; 7317 boolean_t haspeer; 7318 ipsa_t *peer_assoc, *dying; 7319 /* 7320 * Haspeer cases will contain both IPv4 and IPv6. This code 7321 * is address independent. 7322 */ 7323 while (haspeerlist != NULL) { 7324 /* "dying" contains the SA that has a peer. */ 7325 dying = haspeerlist->ipsa; 7326 haspeer = (dying->ipsa_haspeer); 7327 listptr = haspeerlist; 7328 haspeerlist = listptr->next; 7329 kmem_free(listptr, sizeof (*listptr)); 7330 /* 7331 * Pick peer bucket based on addrfam. 7332 */ 7333 if (outbound) { 7334 if (haspeer) 7335 bucket = INBOUND_BUCKET(sp, dying->ipsa_spi); 7336 else 7337 bucket = INBOUND_BUCKET(sp, 7338 dying->ipsa_otherspi); 7339 } else { /* inbound */ 7340 if (haspeer) { 7341 if (dying->ipsa_addrfam == AF_INET6) { 7342 outhash = OUTBOUND_HASH_V6(sp, 7343 *((in6_addr_t *)&dying-> 7344 ipsa_dstaddr)); 7345 } else { 7346 outhash = OUTBOUND_HASH_V4(sp, 7347 *((ipaddr_t *)&dying-> 7348 ipsa_dstaddr)); 7349 } 7350 } else if (dying->ipsa_addrfam == AF_INET6) { 7351 outhash = OUTBOUND_HASH_V6(sp, 7352 *((in6_addr_t *)&dying-> 7353 ipsa_srcaddr)); 7354 } else { 7355 outhash = OUTBOUND_HASH_V4(sp, 7356 *((ipaddr_t *)&dying-> 7357 ipsa_srcaddr)); 7358 } 7359 bucket = &(sp->sdb_of[outhash]); 7360 } 7361 7362 mutex_enter(&bucket->isaf_lock); 7363 /* 7364 * "haspeer" SA's have the same src/dst address ordering, 7365 * "paired" SA's have the src/dst addresses reversed. 7366 */ 7367 if (haspeer) { 7368 peer_assoc = ipsec_getassocbyspi(bucket, 7369 dying->ipsa_spi, dying->ipsa_srcaddr, 7370 dying->ipsa_dstaddr, dying->ipsa_addrfam); 7371 } else { 7372 peer_assoc = ipsec_getassocbyspi(bucket, 7373 dying->ipsa_otherspi, dying->ipsa_dstaddr, 7374 dying->ipsa_srcaddr, dying->ipsa_addrfam); 7375 } 7376 7377 mutex_exit(&bucket->isaf_lock); 7378 if (peer_assoc != NULL) { 7379 mutex_enter(&peer_assoc->ipsa_lock); 7380 mutex_enter(&dying->ipsa_lock); 7381 if (!haspeer) { 7382 /* 7383 * Only SA's which have a "peer" or are 7384 * "paired" end up on this list, so this 7385 * must be a "paired" SA, update the flags 7386 * to break the pair. 7387 */ 7388 peer_assoc->ipsa_otherspi = 0; 7389 peer_assoc->ipsa_flags &= ~IPSA_F_PAIRED; 7390 dying->ipsa_otherspi = 0; 7391 dying->ipsa_flags &= ~IPSA_F_PAIRED; 7392 } 7393 if (haspeer || outbound) { 7394 /* 7395 * Update the state of the "inbound" SA when 7396 * the "outbound" SA has expired. Don't update 7397 * the "outbound" SA when the "inbound" SA 7398 * SA expires because setting the hard_addtime 7399 * below will cause this to happen. 7400 */ 7401 peer_assoc->ipsa_state = dying->ipsa_state; 7402 } 7403 if (dying->ipsa_state == IPSA_STATE_DEAD) 7404 peer_assoc->ipsa_hardexpiretime = 1; 7405 7406 mutex_exit(&dying->ipsa_lock); 7407 mutex_exit(&peer_assoc->ipsa_lock); 7408 IPSA_REFRELE(peer_assoc); 7409 } 7410 IPSA_REFRELE(dying); 7411 } 7412 } 7413